File name:

b270dc5356cf7792aa8d35853b009e7bb36c22279342d8505feadb9633b77c6e

Full analysis: https://app.any.run/tasks/dd7baa02-4c88-4fad-84e2-97833be31d59
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 20:39:20
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
remcos
rat
auto-reg
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections
MD5:

BD214C7435A77023A31402E38B602DD2

SHA1:

A8943FEBACE1E241CEC03E6CE65B171466C8C70A

SHA256:

B270DC5356CF7792AA8D35853B009E7BB36C22279342D8505FEADB9633B77C6E

SSDEEP:

12288:JVVVVVzTS/ytKMqhlcMAIPDvx8NaQImmSUVVVVVC:DKytK7hlcMAIPDviarmmSn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • hab.exe (PID: 3888)
      • hab.exe (PID: 4696)
      • hab.exe (PID: 4112)
      • hab.exe (PID: 4008)
      • hab.exe (PID: 2564)
      • hab.exe (PID: 1764)
      • hab.exe (PID: 5576)
      • hab.exe (PID: 4008)
      • hab.exe (PID: 6436)
      • hab.exe (PID: 5596)
      • hab.exe (PID: 6080)
      • hab.exe (PID: 4188)
      • hab.exe (PID: 6028)
      • hab.exe (PID: 6264)
      • hab.exe (PID: 2240)
      • hab.exe (PID: 6512)
      • hab.exe (PID: 5508)
      • hab.exe (PID: 6652)
      • hab.exe (PID: 5528)
      • hab.exe (PID: 4008)

    • REMCOS mutex has been found

      • hab.exe (PID: 4696)
      • hab.exe (PID: 4008)
      • hab.exe (PID: 1764)
      • hab.exe (PID: 4008)
      • hab.exe (PID: 6436)
      • hab.exe (PID: 4188)
      • hab.exe (PID: 6264)
      • hab.exe (PID: 6512)
      • hab.exe (PID: 6652)
      • hab.exe (PID: 4008)

    • REMCOS has been detected

      • hab.exe (PID: 4696)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 6036)
      • wscript.exe (PID: 6644)
      • wscript.exe (PID: 5552)
      • wscript.exe (PID: 1088)
      • wscript.exe (PID: 2236)
      • wscript.exe (PID: 1184)
      • wscript.exe (PID: 4920)
      • wscript.exe (PID: 6752)
      • wscript.exe (PID: 5216)
      • wscript.exe (PID: 1328)

    • Deletes a file (SCRIPT)

      • wscript.exe (PID: 6036)
      • wscript.exe (PID: 6644)
      • wscript.exe (PID: 1088)
      • wscript.exe (PID: 5552)
      • wscript.exe (PID: 2236)
      • wscript.exe (PID: 1184)
      • wscript.exe (PID: 4920)
      • wscript.exe (PID: 6752)
      • wscript.exe (PID: 5216)
      • wscript.exe (PID: 1328)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • b270dc5356cf7792aa8d35853b009e7bb36c22279342d8505feadb9633b77c6e.exe (PID: 1056)
      • hab.exe (PID: 4696)
      • remcos.exe (PID: 5344)
      • remcos.exe (PID: 300)
      • remcos.exe (PID: 6028)
      • remcos.exe (PID: 1128)
      • remcos.exe (PID: 5680)
      • remcos.exe (PID: 4740)
      • remcos.exe (PID: 5164)
      • remcos.exe (PID: 4736)
      • remcos.exe (PID: 1852)
      • remcos.exe (PID: 2772)
      • remcos.exe (PID: 4220)
      • remcos.exe (PID: 1328)
      • remcos.exe (PID: 5800)
      • remcos.exe (PID: 3888)
      • remcos.exe (PID: 1764)
      • remcos.exe (PID: 6800)
      • remcos.exe (PID: 5776)
      • remcos.exe (PID: 5244)
      • remcos.exe (PID: 5376)
      • remcos.exe (PID: 5680)
      • remcos.exe (PID: 5956)
      • remcos.exe (PID: 6744)
      • remcos.exe (PID: 5136)
      • remcos.exe (PID: 6808)
      • remcos.exe (PID: 4040)
      • remcos.exe (PID: 668)
      • remcos.exe (PID: 1676)
      • remcos.exe (PID: 5364)
      • remcos.exe (PID: 5544)
      • remcos.exe (PID: 1012)
      • remcos.exe (PID: 6824)
      • remcos.exe (PID: 6344)
      • remcos.exe (PID: 4272)
      • remcos.exe (PID: 5188)
      • remcos.exe (PID: 1600)
      • remcos.exe (PID: 6640)
      • remcos.exe (PID: 6700)
      • remcos.exe (PID: 6668)
      • remcos.exe (PID: 632)
      • remcos.exe (PID: 6640)
      • remcos.exe (PID: 3364)
      • remcos.exe (PID: 5512)
      • remcos.exe (PID: 924)
      • remcos.exe (PID: 5720)
      • remcos.exe (PID: 1764)
      • remcos.exe (PID: 4284)
      • remcos.exe (PID: 6640)
      • remcos.exe (PID: 7084)
      • remcos.exe (PID: 6436)
      • remcos.exe (PID: 6468)
      • remcos.exe (PID: 5072)
      • remcos.exe (PID: 4620)
      • remcos.exe (PID: 3364)
      • remcos.exe (PID: 2040)
      • remcos.exe (PID: 3268)
      • remcos.exe (PID: 1616)
      • remcos.exe (PID: 5680)
      • remcos.exe (PID: 1272)
      • remcos.exe (PID: 3884)
      • remcos.exe (PID: 4996)
      • remcos.exe (PID: 3272)
      • remcos.exe (PID: 3024)
      • remcos.exe (PID: 1052)
      • remcos.exe (PID: 2384)
      • remcos.exe (PID: 3012)
      • remcos.exe (PID: 1240)

    • Reads security settings of Internet Explorer

      • b270dc5356cf7792aa8d35853b009e7bb36c22279342d8505feadb9633b77c6e.exe (PID: 1056)
      • hab.exe (PID: 4696)
      • remcos.exe (PID: 5344)
      • hab.exe (PID: 4008)
      • remcos.exe (PID: 300)
      • remcos.exe (PID: 6800)
      • hab.exe (PID: 1764)
      • hab.exe (PID: 4008)
      • remcos.exe (PID: 6028)
      • hab.exe (PID: 6436)
      • remcos.exe (PID: 1128)
      • hab.exe (PID: 4188)
      • remcos.exe (PID: 5680)
      • hab.exe (PID: 6264)
      • remcos.exe (PID: 4740)
      • hab.exe (PID: 6512)
      • remcos.exe (PID: 5164)
      • hab.exe (PID: 6652)
      • remcos.exe (PID: 4736)
      • hab.exe (PID: 4008)

    • Application launched itself

      • b270dc5356cf7792aa8d35853b009e7bb36c22279342d8505feadb9633b77c6e.exe (PID: 3240)
      • hab.exe (PID: 3888)
      • remcos.exe (PID: 5216)
      • hab.exe (PID: 4112)
      • remcos.exe (PID: 1272)
      • remcos.exe (PID: 2136)
      • hab.exe (PID: 2564)
      • hab.exe (PID: 5576)
      • remcos.exe (PID: 1276)
      • hab.exe (PID: 5596)
      • remcos.exe (PID: 6372)
      • hab.exe (PID: 6080)
      • remcos.exe (PID: 2136)
      • hab.exe (PID: 6028)
      • remcos.exe (PID: 4008)
      • hab.exe (PID: 2240)
      • remcos.exe (PID: 6640)
      • hab.exe (PID: 5508)
      • hab.exe (PID: 5528)
      • remcos.exe (PID: 5640)
      • remcos.exe (PID: 6656)
      • hab.exe (PID: 4220)
      • remcos.exe (PID: 5728)
      • hab.exe (PID: 1128)
      • hab.exe (PID: 2108)
      • hab.exe (PID: 5136)
      • remcos.exe (PID: 5084)
      • remcos.exe (PID: 7020)
      • hab.exe (PID: 1676)
      • remcos.exe (PID: 864)
      • remcos.exe (PID: 6080)
      • hab.exe (PID: 3020)
      • remcos.exe (PID: 6584)
      • remcos.exe (PID: 6940)
      • hab.exe (PID: 6344)
      • hab.exe (PID: 6080)
      • remcos.exe (PID: 5508)
      • hab.exe (PID: 2152)
      • remcos.exe (PID: 6668)
      • hab.exe (PID: 1272)
      • remcos.exe (PID: 6268)
      • hab.exe (PID: 4628)
      • remcos.exe (PID: 6660)
      • hab.exe (PID: 4200)
      • remcos.exe (PID: 1852)
      • hab.exe (PID: 6660)
      • remcos.exe (PID: 6372)
      • hab.exe (PID: 1272)
      • remcos.exe (PID: 4528)
      • hab.exe (PID: 780)
      • hab.exe (PID: 6668)
      • remcos.exe (PID: 5164)
      • hab.exe (PID: 3900)
      • remcos.exe (PID: 6252)
      • hab.exe (PID: 3192)
      • remcos.exe (PID: 4692)
      • hab.exe (PID: 3768)
      • remcos.exe (PID: 1660)
      • remcos.exe (PID: 1244)
      • hab.exe (PID: 4756)
      • remcos.exe (PID: 1056)
      • hab.exe (PID: 2320)
      • remcos.exe (PID: 1764)
      • hab.exe (PID: 7144)
      • remcos.exe (PID: 6436)
      • remcos.exe (PID: 4284)
      • hab.exe (PID: 4212)
      • remcos.exe (PID: 6944)
      • hab.exe (PID: 5740)
      • hab.exe (PID: 6476)
      • remcos.exe (PID: 6456)
      • remcos.exe (PID: 3968)
      • hab.exe (PID: 5136)
      • remcos.exe (PID: 3796)
      • hab.exe (PID: 6724)
      • hab.exe (PID: 3676)
      • remcos.exe (PID: 5728)
      • hab.exe (PID: 2664)
      • remcos.exe (PID: 2040)
      • hab.exe (PID: 6808)
      • remcos.exe (PID: 1228)
      • remcos.exe (PID: 3012)
      • remcos.exe (PID: 6972)
      • hab.exe (PID: 7144)
      • remcos.exe (PID: 300)
      • hab.exe (PID: 5164)
      • hab.exe (PID: 5452)
      • hab.exe (PID: 3272)
      • remcos.exe (PID: 4892)
      • remcos.exe (PID: 4284)
      • hab.exe (PID: 5392)
      • hab.exe (PID: 240)
      • remcos.exe (PID: 6972)
      • hab.exe (PID: 5244)
      • remcos.exe (PID: 6576)
      • hab.exe (PID: 2852)
      • hab.exe (PID: 4892)
      • remcos.exe (PID: 6264)
      • hab.exe (PID: 4108)
      • remcos.exe (PID: 5324)
      • remcos.exe (PID: 2340)
      • remcos.exe (PID: 1276)
      • hab.exe (PID: 5528)
      • remcos.exe (PID: 6816)
      • remcos.exe (PID: 3012)
      • hab.exe (PID: 3032)
      • hab.exe (PID: 6264)
      • hab.exe (PID: 7144)
      • hab.exe (PID: 732)
      • remcos.exe (PID: 4152)
      • remcos.exe (PID: 5744)
      • hab.exe (PID: 6612)
      • remcos.exe (PID: 6752)
      • remcos.exe (PID: 4932)
      • hab.exe (PID: 3028)
      • remcos.exe (PID: 1660)
      • hab.exe (PID: 2664)
      • remcos.exe (PID: 208)
      • hab.exe (PID: 4304)
      • hab.exe (PID: 5132)
      • hab.exe (PID: 976)
      • remcos.exe (PID: 4488)
      • hab.exe (PID: 2152)
      • remcos.exe (PID: 236)
      • hab.exe (PID: 780)
      • remcos.exe (PID: 6148)
      • remcos.exe (PID: 4016)
      • remcos.exe (PID: 6436)
      • hab.exe (PID: 1348)
      • hab.exe (PID: 6852)
      • remcos.exe (PID: 5176)
      • hab.exe (PID: 1276)
      • remcos.exe (PID: 2340)
      • hab.exe (PID: 3364)
      • remcos.exe (PID: 6028)
      • hab.exe (PID: 3028)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 6036)
      • wscript.exe (PID: 6644)
      • wscript.exe (PID: 1052)
      • wscript.exe (PID: 5552)
      • wscript.exe (PID: 2236)
      • wscript.exe (PID: 1184)
      • wscript.exe (PID: 4920)
      • wscript.exe (PID: 6752)
      • wscript.exe (PID: 5216)
      • wscript.exe (PID: 1328)

    • The process executes VB scripts

      • hab.exe (PID: 4696)
      • hab.exe (PID: 4008)
      • hab.exe (PID: 1764)
      • hab.exe (PID: 4008)
      • hab.exe (PID: 6436)
      • hab.exe (PID: 4188)
      • hab.exe (PID: 6264)
      • hab.exe (PID: 6512)
      • hab.exe (PID: 6652)
      • hab.exe (PID: 2108)
      • hab.exe (PID: 4008)
      • hab.exe (PID: 3192)
      • hab.exe (PID: 6112)
      • hab.exe (PID: 6964)
      • hab.exe (PID: 6964)
      • hab.exe (PID: 864)
      • hab.exe (PID: 6468)
      • hab.exe (PID: 6584)
      • hab.exe (PID: 2288)
      • hab.exe (PID: 1452)
      • hab.exe (PID: 4068)
      • hab.exe (PID: 6264)
      • hab.exe (PID: 5452)
      • hab.exe (PID: 6940)
      • hab.exe (PID: 5868)
      • hab.exe (PID: 4868)
      • hab.exe (PID: 5680)
      • hab.exe (PID: 3332)
      • hab.exe (PID: 4692)
      • hab.exe (PID: 4180)
      • hab.exe (PID: 2908)
      • hab.exe (PID: 1240)
      • hab.exe (PID: 4728)
      • hab.exe (PID: 1616)
      • hab.exe (PID: 7084)
      • hab.exe (PID: 6808)
      • hab.exe (PID: 4112)
      • hab.exe (PID: 456)
      • hab.exe (PID: 684)
      • hab.exe (PID: 5324)
      • hab.exe (PID: 920)
      • hab.exe (PID: 5964)
      • hab.exe (PID: 5380)
      • hab.exe (PID: 3884)
      • hab.exe (PID: 3020)
      • hab.exe (PID: 5812)
      • hab.exe (PID: 6372)
      • hab.exe (PID: 4608)
      • hab.exe (PID: 924)
      • hab.exe (PID: 4648)
      • hab.exe (PID: 6272)
      • hab.exe (PID: 300)
      • hab.exe (PID: 616)
      • hab.exe (PID: 3032)
      • hab.exe (PID: 1132)
      • hab.exe (PID: 236)
      • hab.exe (PID: 920)
      • hab.exe (PID: 4424)
      • hab.exe (PID: 4528)
      • hab.exe (PID: 2064)
      • hab.exe (PID: 2896)
      • hab.exe (PID: 2772)
      • hab.exe (PID: 5176)
      • hab.exe (PID: 4776)
      • hab.exe (PID: 1452)
      • hab.exe (PID: 5044)
      • hab.exe (PID: 4424)
      • hab.exe (PID: 2800)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 6036)
      • wscript.exe (PID: 6644)
      • wscript.exe (PID: 5552)
      • wscript.exe (PID: 1088)
      • wscript.exe (PID: 2236)
      • wscript.exe (PID: 1184)
      • wscript.exe (PID: 4920)
      • wscript.exe (PID: 6752)
      • wscript.exe (PID: 5216)
      • wscript.exe (PID: 1328)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 6036)
      • wscript.exe (PID: 6644)
      • wscript.exe (PID: 5552)
      • wscript.exe (PID: 2236)
      • wscript.exe (PID: 1184)
      • wscript.exe (PID: 4920)
      • wscript.exe (PID: 6752)
      • wscript.exe (PID: 5216)
      • wscript.exe (PID: 1328)
      • wscript.exe (PID: 5984)
      • wscript.exe (PID: 6640)
      • wscript.exe (PID: 5984)
      • wscript.exe (PID: 744)
      • wscript.exe (PID: 1276)
      • wscript.exe (PID: 6828)
      • wscript.exe (PID: 1272)
      • wscript.exe (PID: 496)
      • wscript.exe (PID: 5640)
      • wscript.exe (PID: 2040)
      • wscript.exe (PID: 7012)
      • wscript.exe (PID: 6112)
      • wscript.exe (PID: 6576)
      • wscript.exe (PID: 3020)
      • wscript.exe (PID: 872)
      • wscript.exe (PID: 4212)
      • wscript.exe (PID: 4892)
      • wscript.exe (PID: 6668)
      • wscript.exe (PID: 1452)
      • wscript.exe (PID: 4424)
      • wscript.exe (PID: 6344)
      • wscript.exe (PID: 736)
      • wscript.exe (PID: 5364)
      • wscript.exe (PID: 5544)
      • wscript.exe (PID: 6112)
      • wscript.exe (PID: 1012)
      • wscript.exe (PID: 6824)
      • wscript.exe (PID: 5228)
      • wscript.exe (PID: 812)
      • wscript.exe (PID: 728)
      • wscript.exe (PID: 5680)
      • wscript.exe (PID: 3768)
      • wscript.exe (PID: 4932)
      • wscript.exe (PID: 6876)
      • wscript.exe (PID: 3976)
      • wscript.exe (PID: 6072)
      • wscript.exe (PID: 3192)
      • wscript.exe (PID: 6228)
      • wscript.exe (PID: 2148)
      • wscript.exe (PID: 5200)
      • wscript.exe (PID: 2240)
      • wscript.exe (PID: 5952)
      • wscript.exe (PID: 4728)
      • wscript.exe (PID: 5036)
      • wscript.exe (PID: 5964)
      • wscript.exe (PID: 300)
      • wscript.exe (PID: 1852)
      • wscript.exe (PID: 5936)
      • wscript.exe (PID: 2596)
      • wscript.exe (PID: 5600)
      • wscript.exe (PID: 6652)
      • wscript.exe (PID: 5956)
      • wscript.exe (PID: 2908)
      • wscript.exe (PID: 872)
      • wscript.exe (PID: 4012)
      • wscript.exe (PID: 7020)
      • wscript.exe (PID: 5812)

    • Gets full path of the running script (SCRIPT)

      • wscript.exe (PID: 6036)
      • wscript.exe (PID: 6644)
      • wscript.exe (PID: 5552)
      • wscript.exe (PID: 2236)
      • wscript.exe (PID: 1184)
      • wscript.exe (PID: 4920)
      • wscript.exe (PID: 6752)
      • wscript.exe (PID: 5216)
      • wscript.exe (PID: 1328)

    • The executable file from the user directory is run by the CMD process

      • remcos.exe (PID: 5216)
      • remcos.exe (PID: 1272)
      • remcos.exe (PID: 1276)
      • remcos.exe (PID: 6372)
      • remcos.exe (PID: 2136)
      • remcos.exe (PID: 4008)
      • remcos.exe (PID: 6640)
      • remcos.exe (PID: 5640)
      • remcos.exe (PID: 6656)
      • remcos.exe (PID: 5728)
      • remcos.exe (PID: 7020)
      • remcos.exe (PID: 5084)
      • remcos.exe (PID: 6080)
      • remcos.exe (PID: 6584)
      • remcos.exe (PID: 6940)
      • remcos.exe (PID: 864)
      • remcos.exe (PID: 5508)
      • remcos.exe (PID: 6668)
      • remcos.exe (PID: 6268)
      • remcos.exe (PID: 6660)
      • remcos.exe (PID: 1852)
      • remcos.exe (PID: 6372)
      • remcos.exe (PID: 4528)
      • remcos.exe (PID: 5164)
      • remcos.exe (PID: 6252)
      • remcos.exe (PID: 4692)
      • remcos.exe (PID: 1244)
      • remcos.exe (PID: 1056)
      • remcos.exe (PID: 1660)
      • remcos.exe (PID: 1764)
      • remcos.exe (PID: 6436)
      • remcos.exe (PID: 4284)
      • remcos.exe (PID: 6944)
      • remcos.exe (PID: 3968)
      • remcos.exe (PID: 3796)
      • remcos.exe (PID: 6456)
      • remcos.exe (PID: 2040)
      • remcos.exe (PID: 1228)
      • remcos.exe (PID: 5728)
      • remcos.exe (PID: 6972)
      • remcos.exe (PID: 300)
      • remcos.exe (PID: 3012)
      • remcos.exe (PID: 4284)
      • remcos.exe (PID: 4892)
      • remcos.exe (PID: 6972)
      • remcos.exe (PID: 6576)
      • remcos.exe (PID: 6264)
      • remcos.exe (PID: 5324)
      • remcos.exe (PID: 2340)
      • remcos.exe (PID: 1276)
      • remcos.exe (PID: 6816)
      • remcos.exe (PID: 3012)
      • remcos.exe (PID: 4152)
      • remcos.exe (PID: 5744)
      • remcos.exe (PID: 6752)
      • remcos.exe (PID: 4932)
      • remcos.exe (PID: 1660)
      • remcos.exe (PID: 208)
      • remcos.exe (PID: 4488)
      • remcos.exe (PID: 236)
      • remcos.exe (PID: 6148)
      • remcos.exe (PID: 6436)
      • remcos.exe (PID: 5176)
      • remcos.exe (PID: 4016)
      • remcos.exe (PID: 2340)
      • remcos.exe (PID: 6028)

  • INFO

    • Reads the computer name

      • b270dc5356cf7792aa8d35853b009e7bb36c22279342d8505feadb9633b77c6e.exe (PID: 3240)
      • b270dc5356cf7792aa8d35853b009e7bb36c22279342d8505feadb9633b77c6e.exe (PID: 1056)
      • hab.exe (PID: 3888)
      • hab.exe (PID: 4696)
      • remcos.exe (PID: 5216)
      • remcos.exe (PID: 5344)
      • hab.exe (PID: 4008)
      • hab.exe (PID: 4112)
      • remcos.exe (PID: 1272)
      • remcos.exe (PID: 2136)
      • hab.exe (PID: 2564)
      • remcos.exe (PID: 6800)
      • hab.exe (PID: 1764)
      • remcos.exe (PID: 300)
      • hab.exe (PID: 5576)
      • hab.exe (PID: 4008)
      • remcos.exe (PID: 1276)
      • remcos.exe (PID: 6028)
      • hab.exe (PID: 5596)
      • hab.exe (PID: 6436)
      • remcos.exe (PID: 6372)
      • remcos.exe (PID: 1128)
      • hab.exe (PID: 6080)
      • hab.exe (PID: 4188)
      • remcos.exe (PID: 2136)
      • remcos.exe (PID: 5680)
      • hab.exe (PID: 6028)
      • hab.exe (PID: 6264)
      • remcos.exe (PID: 4008)
      • remcos.exe (PID: 4740)
      • hab.exe (PID: 6512)
      • hab.exe (PID: 2240)
      • remcos.exe (PID: 6640)
      • remcos.exe (PID: 5164)
      • hab.exe (PID: 5508)
      • hab.exe (PID: 6652)
      • remcos.exe (PID: 5640)
      • remcos.exe (PID: 4736)
      • hab.exe (PID: 5528)
      • hab.exe (PID: 4008)
      • remcos.exe (PID: 6656)
      • remcos.exe (PID: 1852)

    • Create files in a temporary directory

      • b270dc5356cf7792aa8d35853b009e7bb36c22279342d8505feadb9633b77c6e.exe (PID: 3240)
      • b270dc5356cf7792aa8d35853b009e7bb36c22279342d8505feadb9633b77c6e.exe (PID: 1056)
      • hab.exe (PID: 3888)
      • hab.exe (PID: 4696)
      • remcos.exe (PID: 5216)
      • remcos.exe (PID: 5344)
      • hab.exe (PID: 4112)
      • hab.exe (PID: 4008)
      • remcos.exe (PID: 1272)
      • remcos.exe (PID: 2136)
      • remcos.exe (PID: 300)
      • hab.exe (PID: 2564)
      • remcos.exe (PID: 6800)
      • hab.exe (PID: 1764)
      • hab.exe (PID: 5576)
      • hab.exe (PID: 4008)
      • remcos.exe (PID: 1276)
      • remcos.exe (PID: 6028)
      • hab.exe (PID: 6436)
      • hab.exe (PID: 5596)
      • remcos.exe (PID: 6372)
      • remcos.exe (PID: 1128)
      • hab.exe (PID: 6080)
      • hab.exe (PID: 4188)
      • remcos.exe (PID: 2136)
      • remcos.exe (PID: 5680)
      • hab.exe (PID: 6264)
      • hab.exe (PID: 6028)
      • remcos.exe (PID: 4008)
      • remcos.exe (PID: 4740)
      • hab.exe (PID: 6512)
      • hab.exe (PID: 2240)
      • remcos.exe (PID: 5164)
      • remcos.exe (PID: 6640)
      • hab.exe (PID: 5508)
      • hab.exe (PID: 6652)
      • remcos.exe (PID: 5640)
      • remcos.exe (PID: 4736)
      • hab.exe (PID: 5528)
      • hab.exe (PID: 4008)
      • remcos.exe (PID: 6656)
      • remcos.exe (PID: 1852)

    • Checks supported languages

      • b270dc5356cf7792aa8d35853b009e7bb36c22279342d8505feadb9633b77c6e.exe (PID: 3240)
      • hab.exe (PID: 3888)
      • b270dc5356cf7792aa8d35853b009e7bb36c22279342d8505feadb9633b77c6e.exe (PID: 1056)
      • hab.exe (PID: 4696)
      • remcos.exe (PID: 5216)
      • hab.exe (PID: 4112)
      • hab.exe (PID: 4008)
      • remcos.exe (PID: 5344)
      • remcos.exe (PID: 2136)
      • remcos.exe (PID: 1272)
      • remcos.exe (PID: 300)
      • hab.exe (PID: 2564)
      • hab.exe (PID: 1764)
      • remcos.exe (PID: 6800)
      • hab.exe (PID: 5576)
      • hab.exe (PID: 4008)
      • remcos.exe (PID: 1276)
      • remcos.exe (PID: 6028)
      • hab.exe (PID: 5596)
      • hab.exe (PID: 6436)
      • remcos.exe (PID: 6372)
      • remcos.exe (PID: 1128)
      • hab.exe (PID: 6080)
      • hab.exe (PID: 4188)
      • remcos.exe (PID: 2136)
      • remcos.exe (PID: 5680)
      • hab.exe (PID: 6028)
      • hab.exe (PID: 6264)
      • remcos.exe (PID: 4008)
      • remcos.exe (PID: 4740)
      • hab.exe (PID: 2240)
      • hab.exe (PID: 6512)
      • remcos.exe (PID: 6640)
      • remcos.exe (PID: 5164)
      • hab.exe (PID: 6652)
      • hab.exe (PID: 5508)
      • remcos.exe (PID: 5640)
      • hab.exe (PID: 5528)
      • hab.exe (PID: 4008)
      • remcos.exe (PID: 4736)
      • remcos.exe (PID: 6656)
      • remcos.exe (PID: 1852)

    • Process checks computer location settings

      • b270dc5356cf7792aa8d35853b009e7bb36c22279342d8505feadb9633b77c6e.exe (PID: 1056)
      • hab.exe (PID: 4696)
      • remcos.exe (PID: 5344)
      • hab.exe (PID: 4008)
      • remcos.exe (PID: 300)
      • remcos.exe (PID: 6800)
      • hab.exe (PID: 1764)
      • hab.exe (PID: 4008)
      • hab.exe (PID: 6436)
      • remcos.exe (PID: 6028)
      • remcos.exe (PID: 1128)
      • hab.exe (PID: 4188)
      • remcos.exe (PID: 5680)
      • hab.exe (PID: 6264)
      • remcos.exe (PID: 4740)
      • hab.exe (PID: 6512)
      • remcos.exe (PID: 5164)
      • hab.exe (PID: 6652)
      • remcos.exe (PID: 4736)
      • hab.exe (PID: 4008)

    • Auto-launch of the file from Registry key

      • hab.exe (PID: 3888)
      • hab.exe (PID: 4696)
      • hab.exe (PID: 4112)
      • hab.exe (PID: 4008)
      • hab.exe (PID: 2564)
      • hab.exe (PID: 1764)
      • hab.exe (PID: 5576)
      • hab.exe (PID: 4008)
      • hab.exe (PID: 5596)
      • hab.exe (PID: 6436)
      • hab.exe (PID: 6080)
      • hab.exe (PID: 4188)
      • hab.exe (PID: 6264)
      • hab.exe (PID: 6028)
      • hab.exe (PID: 2240)
      • hab.exe (PID: 6512)
      • hab.exe (PID: 6652)
      • hab.exe (PID: 5508)
      • hab.exe (PID: 4008)
      • hab.exe (PID: 5528)

    • Creates files or folders in the user directory

      • hab.exe (PID: 4696)

    • Manual execution by a user

      • wscript.exe (PID: 1052)
      • remcos.exe (PID: 2136)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Microsoft Visual Basic 6 (84.4)
.dll | Win32 Dynamic Link Library (generic) (6.7)
.exe | Win32 Executable (generic) (4.6)
.exe | Generic Win/DOS Executable (2)
.exe | DOS Executable Generic (2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:05:12 22:35:37+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 364544
InitializedDataSize: 24576
UninitializedDataSize: -
EntryPoint: 0x1274
OSVersion: 4
ImageVersion: 7.5
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 7.5.0.5
ProductVersionNumber: 7.5.0.5
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: sIemENs
ProductName: lsg
FileVersion: 7.05.0005
ProductVersion: 7.05.0005
InternalName: syd
OriginalFileName: syd.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
598
Monitored processes
474
Malicious processes
47
Suspicious processes
14

Behavior graph

Click at the process to see the details
start b270dc5356cf7792aa8d35853b009e7bb36c22279342d8505feadb9633b77c6e.exe no specs b270dc5356cf7792aa8d35853b009e7bb36c22279342d8505feadb9633b77c6e.exe hab.exe #REMCOS hab.exe wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe #REMCOS hab.exe wscript.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe no specs remcos.exe hab.exe remcos.exe no specs #REMCOS hab.exe hab.exe wscript.exe no specs #REMCOS hab.exe wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe #REMCOS hab.exe wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe #REMCOS hab.exe wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe #REMCOS hab.exe wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe #REMCOS hab.exe wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe #REMCOS hab.exe wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe #REMCOS hab.exe wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs slui.exe cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe hab.exe no specs hab.exe no specs wscript.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
208C:\Users\admin\AppData\Roaming\remcos\remcos.exeC:\Users\admin\AppData\Roaming\remcos\remcos.exe—cmd.exe
User:
admin
Company:
sIemENs
Integrity Level:
MEDIUM
Exit code:
0
Version:
7.05.0005
Modules
Images
c:\users\admin\appdata\roaming\remcos\remcos.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvbvm60.dll
c:\windows\syswow64\user32.dll
236"C:\Users\admin\AppData\Local\Temp\hab.exe" C:\Users\admin\AppData\Local\Temp\hab.exe—hab.exe
User:
admin
Company:
sIemENs
Integrity Level:
MEDIUM
Exit code:
0
Version:
7.05.0005
Modules
Images
c:\users\admin\appdata\local\temp\hab.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvbvm60.dll
c:\windows\syswow64\user32.dll
236C:\Users\admin\AppData\Roaming\remcos\remcos.exeC:\Users\admin\AppData\Roaming\remcos\remcos.exe—cmd.exe
User:
admin
Company:
sIemENs
Integrity Level:
MEDIUM
Exit code:
0
Version:
7.05.0005
Modules
Images
c:\users\admin\appdata\roaming\remcos\remcos.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvbvm60.dll
c:\windows\syswow64\user32.dll
240"C:\Users\admin\AppData\Local\Temp\hab.exe" C:\Users\admin\AppData\Local\Temp\hab.exe—remcos.exe
User:
admin
Company:
sIemENs
Integrity Level:
MEDIUM
Exit code:
0
Version:
7.05.0005
Modules
Images
c:\users\admin\appdata\local\temp\hab.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvbvm60.dll
c:\windows\syswow64\user32.dll
300C:\Users\admin\AppData\Roaming\remcos\remcos.exeC:\Users\admin\AppData\Roaming\remcos\remcos.exe
remcos.exe
User:
admin
Company:
sIemENs
Integrity Level:
MEDIUM
Exit code:
0
Version:
7.05.0005
Modules
Images
c:\users\admin\appdata\roaming\remcos\remcos.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvbvm60.dll
c:\windows\syswow64\user32.dll
300\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
300C:\Users\admin\AppData\Roaming\remcos\remcos.exeC:\Users\admin\AppData\Roaming\remcos\remcos.exe—cmd.exe
User:
admin
Company:
sIemENs
Integrity Level:
MEDIUM
Exit code:
0
Version:
7.05.0005
Modules
Images
c:\users\admin\appdata\roaming\remcos\remcos.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvbvm60.dll
c:\windows\syswow64\user32.dll
300"C:\Users\admin\AppData\Local\Temp\hab.exe" C:\Users\admin\AppData\Local\Temp\hab.exe—hab.exe
User:
admin
Company:
sIemENs
Integrity Level:
MEDIUM
Exit code:
0
Version:
7.05.0005
Modules
Images
c:\users\admin\appdata\local\temp\hab.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvbvm60.dll
c:\windows\syswow64\user32.dll
300"C:\WINDOWS\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\install.vbs" C:\Windows\SysWOW64\wscript.exe—hab.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\syswow64\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
444"C:\Windows\System32\cmd.exe" /c "C:\Users\admin\AppData\Roaming\remcos\remcos.exe"C:\Windows\SysWOW64\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
94 119
Read events
93 915
Write events
204
Delete events
0

Modification events

(PID) Process:(4696) hab.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:remcos
Value:
"C:\Users\admin\AppData\Roaming\remcos\remcos.exe"
(PID) Process:(4696) hab.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbs\OpenWithProgids
Operation:writeName:VBSFile
Value:
(PID) Process:(3888) hab.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:bru
Value:
wscript "C:\Users\admin\AppData\Local\Temp\hab.vbs"
(PID) Process:(4008) hab.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:remcos
Value:
"C:\Users\admin\AppData\Roaming\remcos\remcos.exe"
(PID) Process:(4112) hab.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:bru
Value:
wscript "C:\Users\admin\AppData\Local\Temp\hab.vbs"
(PID) Process:(4008) hab.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbs\OpenWithProgids
Operation:writeName:VBSFile
Value:
(PID) Process:(1764) hab.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:remcos
Value:
"C:\Users\admin\AppData\Roaming\remcos\remcos.exe"
(PID) Process:(1764) hab.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbs\OpenWithProgids
Operation:writeName:VBSFile
Value:
(PID) Process:(5576) hab.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:bru
Value:
wscript "C:\Users\admin\AppData\Local\Temp\hab.vbs"
(PID) Process:(2564) hab.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:bru
Value:
wscript "C:\Users\admin\AppData\Local\Temp\hab.vbs"
Executable files
68
Suspicious files
341
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
4112hab.exeC:\Users\admin\AppData\Local\Temp\~DF4D8A38E686A0BB02.TMPbinary
MD5:4679888761734AE3A704FA11391A2AB3
SHA256:CF26E34C18B7C04FF2570658E4399ABF1D5024BAA633118C5E71898290DA7924
300remcos.exeC:\Users\admin\AppData\Local\Temp\~DFD1E93FC24D7A7643.TMPbinary
MD5:4679888761734AE3A704FA11391A2AB3
SHA256:CF26E34C18B7C04FF2570658E4399ABF1D5024BAA633118C5E71898290DA7924
4008hab.exeC:\Users\admin\AppData\Local\Temp\install.vbsbinary
MD5:B4065D71E297AE8E522011D688B5846D
SHA256:A21DFD9D42688E7B53B227211B23AE5F6435C0F7CCA26A2CAA8C70FD1D1EFE1B
300remcos.exeC:\Users\admin\AppData\Local\Temp\hab.exeexecutable
MD5:DBF40F8DB320FDCD93F839728C260A2E
SHA256:F428F1964233F15E8149467C0D453E4986EFE9B876AE3EFA09561A06E2C507D1
4008hab.exeC:\Users\admin\AppData\Local\Temp\~DFE6ED73DE59769A10.TMPbinary
MD5:4679888761734AE3A704FA11391A2AB3
SHA256:CF26E34C18B7C04FF2570658E4399ABF1D5024BAA633118C5E71898290DA7924
4696hab.exeC:\Users\admin\AppData\Roaming\remcos\remcos.exeexecutable
MD5:2C2A19A2BBB7E7F2288AB22DE1198E61
SHA256:52E6DB96B52EBAA9E911587561F3388CE9C319CE403172922E8DDC5A35AC6AA4
4696hab.exeC:\Users\admin\AppData\Local\Temp\install.vbsbinary
MD5:B4065D71E297AE8E522011D688B5846D
SHA256:A21DFD9D42688E7B53B227211B23AE5F6435C0F7CCA26A2CAA8C70FD1D1EFE1B
5344remcos.exeC:\Users\admin\AppData\Local\Temp\hab.exeexecutable
MD5:89951C4BEEF162C9C3F1EDBBE9E9141C
SHA256:F03937CAD245CC403714F53D27B1E0D1D46B2B658A72281668282FEDFD2CE1E4
1056b270dc5356cf7792aa8d35853b009e7bb36c22279342d8505feadb9633b77c6e.exeC:\Users\admin\AppData\Local\Temp\hab.exeexecutable
MD5:2C2A19A2BBB7E7F2288AB22DE1198E61
SHA256:52E6DB96B52EBAA9E911587561F3388CE9C319CE403172922E8DDC5A35AC6AA4
3240b270dc5356cf7792aa8d35853b009e7bb36c22279342d8505feadb9633b77c6e.exeC:\Users\admin\AppData\Local\Temp\~DF9DCA1CBEB246EE28.TMPbinary
MD5:4679888761734AE3A704FA11391A2AB3
SHA256:CF26E34C18B7C04FF2570658E4399ABF1D5024BAA633118C5E71898290DA7924
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
32
TCP/UDP connections
52
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
304
20.109.210.53:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
1324
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
1324
SIHClient.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
1324
SIHClient.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
1324
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
1324
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
—
—
GET
200
20.109.210.53:443
https://slscr.update.microsoft.com/sls/ping
unknown
—
—
—
1324
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
2.16.168.124:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2104
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
6544
svchost.exe
20.190.160.67:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1324
SIHClient.exe
20.109.210.53:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.78
whitelisted
crl.microsoft.com
  • 2.16.168.124
  • 2.16.168.114
  • 2.16.241.19
  • 2.16.241.12
whitelisted
client.wns.windows.com
  • 172.211.123.250
  • 172.211.123.248
  • 172.211.123.249
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
login.live.com
  • 20.190.160.67
  • 20.190.160.131
  • 20.190.160.17
  • 20.190.160.22
  • 40.126.32.138
  • 20.190.160.5
  • 20.190.160.14
  • 20.190.160.130
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.48
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
b270dc5356cf7792aa8d35853b009e7bb36c22279342d8505feadb9633b77c6e