File name:

2025-03-24_9dc90a8fa77c266ef33869fd32236d38_bkransomware_floxif_remcos

Full analysis: https://app.any.run/tasks/786d5908-67eb-4a7d-9a23-93b0cf441c23
Verdict: Malicious activity
Analysis date: March 24, 2025, 13:17:10
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

9DC90A8FA77C266EF33869FD32236D38

SHA1:

9E61F52BCC0E2755A49778ADDBB8F996885D73C4

SHA256:

B3D2DF4D75A0B52E33CE12ADAE2DF3EC1F8BAE687ED3BCDD55D227A7DD8A4DBC

SSDEEP:

98304:tidriOwDOe6YKixPMgpgE9fXCCudJv7xQ34/DBqINdbuxY6IeWrBLNbdD/syV3/X:+hgm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • 2025-03-24_9dc90a8fa77c266ef33869fd32236d38_bkransomware_floxif_remcos.exe (PID: 4724)
      • 2025-03-24_9dc90a8fa77c266ef33869fd32236d38_bkransomware_floxif_remcos.exe (PID: 6572)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 2025-03-24_9dc90a8fa77c266ef33869fd32236d38_bkransomware_floxif_remcos.exe (PID: 6572)

    • Process drops legitimate windows executable

      • 2025-03-24_9dc90a8fa77c266ef33869fd32236d38_bkransomware_floxif_remcos.exe (PID: 6572)

  • INFO

    • The sample compiled with english language support

      • 2025-03-24_9dc90a8fa77c266ef33869fd32236d38_bkransomware_floxif_remcos.exe (PID: 6572)

    • Creates files in the program directory

      • 2025-03-24_9dc90a8fa77c266ef33869fd32236d38_bkransomware_floxif_remcos.exe (PID: 6572)

    • Checks supported languages

      • 2025-03-24_9dc90a8fa77c266ef33869fd32236d38_bkransomware_floxif_remcos.exe (PID: 6572)

    • Creates files or folders in the user directory

      • 2025-03-24_9dc90a8fa77c266ef33869fd32236d38_bkransomware_floxif_remcos.exe (PID: 6572)

    • Reads the computer name

      • 2025-03-24_9dc90a8fa77c266ef33869fd32236d38_bkransomware_floxif_remcos.exe (PID: 6572)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (3.6)
.exe | Generic Win/DOS Executable (1.6)
.exe | DOS Executable Generic (1.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2015:04:09 07:16:36+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 3257344
InitializedDataSize: 6952960
UninitializedDataSize: -
EntryPoint: 0x26b824
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 35.0.61.54677
ProductVersionNumber: 35.0.61.54677
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
Comments: USBSetup.exe
OriginalFileName: USBSetup.exe
InternalName: USBSetup
CompanyName: Hewlett-Packard Development Company, LP
LegalCopyright: Copyright (C) Hewlett-Packard Co. 2014
LegalTrademarks: -
FileDescription: USBSetup.exe
FileVersion: 35.0.61.54677
ProductName: HP Digital Imaging
ProductVersion: 035.000.061.54677
ProductFamily: HP Digital Imaging
ProductFileFlags: 1
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
134
Monitored processes
3
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 2025-03-24_9dc90a8fa77c266ef33869fd32236d38_bkransomware_floxif_remcos.exe slui.exe 2025-03-24_9dc90a8fa77c266ef33869fd32236d38_bkransomware_floxif_remcos.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
4724"C:\Users\admin\Desktop\2025-03-24_9dc90a8fa77c266ef33869fd32236d38_bkransomware_floxif_remcos.exe" C:\Users\admin\Desktop\2025-03-24_9dc90a8fa77c266ef33869fd32236d38_bkransomware_floxif_remcos.exe—explorer.exe
User:
admin
Company:
Hewlett-Packard Development Company, LP
Integrity Level:
MEDIUM
Description:
USBSetup.exe
Exit code:
3221226540
Version:
35.0.61.54677
Modules
Images
c:\users\admin\desktop\2025-03-24_9dc90a8fa77c266ef33869fd32236d38_bkransomware_floxif_remcos.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
6424C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6572"C:\Users\admin\Desktop\2025-03-24_9dc90a8fa77c266ef33869fd32236d38_bkransomware_floxif_remcos.exe" C:\Users\admin\Desktop\2025-03-24_9dc90a8fa77c266ef33869fd32236d38_bkransomware_floxif_remcos.exe
explorer.exe
User:
admin
Company:
Hewlett-Packard Development Company, LP
Integrity Level:
HIGH
Description:
USBSetup.exe
Exit code:
87
Version:
35.0.61.54677
Modules
Images
c:\users\admin\desktop\2025-03-24_9dc90a8fa77c266ef33869fd32236d38_bkransomware_floxif_remcos.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
3 384
Read events
3 384
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
1
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
65722025-03-24_9dc90a8fa77c266ef33869fd32236d38_bkransomware_floxif_remcos.exeC:\Program Files\Common Files\System\symsrv.dllexecutable
MD5:7574CF2C64F35161AB1292E2F532AABF
SHA256:DE055A89DE246E629A8694BDE18AF2B1605E4B9B493C7E4AEF669DD67ACF5085
65722025-03-24_9dc90a8fa77c266ef33869fd32236d38_bkransomware_floxif_remcos.exeC:\Users\admin\AppData\Local\HP\AtInstall\HPDeviceSetupTimeSizeLog.txttext
MD5:F2071C93F63665499E85646F85801EAC
SHA256:F05614C5B1F14827928C4F0C68991639319C6B47557512F2FE6E80DA206B14E3
65722025-03-24_9dc90a8fa77c266ef33869fd32236d38_bkransomware_floxif_remcos.exeC:\Users\admin\AppData\Local\HP\AtInstall\001\2025-03-24_9dc90a8fa77c266ef33869fd32236d38_bkransomware_floxif_remcos.logbinary
MD5:5CA1DC90E8A4D02EB6C93F8CB9DE3576
SHA256:4D8302E950F4FDCFC41DDBA471B1AE0F1E2E119E857516A0A6C65BE430DD1BF6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
31
TCP/UDP connections
46
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
976
RUXIMICS.exe
GET
200
23.48.23.169:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4244
SIHClient.exe
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
4244
SIHClient.exe
GET
200
2.19.217.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4244
SIHClient.exe
GET
200
2.19.217.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
4244
SIHClient.exe
GET
200
2.19.217.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
—
—
GET
304
20.109.210.53:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
4244
SIHClient.exe
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
4244
SIHClient.exe
GET
200
2.19.217.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
4244
SIHClient.exe
GET
200
2.19.217.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
—
—
GET
200
20.242.39.171:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
976
RUXIMICS.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
40.126.32.76:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
40.126.32.76:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
976
RUXIMICS.exe
23.48.23.169:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6668
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
google.com
  • 172.217.16.142
whitelisted
login.live.com
  • 40.126.32.76
  • 40.126.32.136
  • 20.190.160.67
  • 40.126.32.140
  • 40.126.32.72
  • 20.190.160.130
  • 20.190.160.132
  • 20.190.160.5
  • 20.190.159.4
  • 20.190.159.129
  • 20.190.159.128
  • 20.190.159.0
  • 40.126.31.129
  • 20.190.159.130
  • 40.126.31.71
  • 40.126.31.3
whitelisted
client.wns.windows.com
  • 40.115.3.253
  • 20.198.162.76
whitelisted
crl.microsoft.com
  • 23.48.23.169
  • 23.48.23.178
  • 23.48.23.168
  • 23.48.23.137
  • 23.48.23.159
  • 23.48.23.181
  • 23.48.23.191
  • 23.48.23.177
  • 23.48.23.194
  • 2.16.168.114
  • 2.16.168.124
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
www.microsoft.com
  • 2.19.217.218
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-03-24_9dc90a8fa77c266ef33869fd32236d38_bkransomware_floxif_remcos