analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://cykhardware.com/remittance.jar

Full analysis: https://app.any.run/tasks/0be3a5c5-53aa-4e97-9335-8320473036e8
Verdict: Malicious activity
Threats:

Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat, and JSocket, is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.

Malware Trends Tracker     >>>
Analysis date: November 18, 2019, 12:24:39
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adwind
trojan
Indicators:
MD5:

C9C897740062CB709464EF4D7E658E9C

SHA1:

4E59C92A9720C14D489DBC42B564D3825972C6B3

SHA256:

B52C67C7AEED9B8D1C278C75AF72C83B21D6132866BB5431466F9536D0FEDA78

SSDEEP:

3:N8BOW0DGKn+3ELXAXn:24W043ETy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AdWind was detected

      • java.exe (PID: 1252)

    • Application was dropped or rewritten from another process

      • java.exe (PID: 1252)
      • javaw.exe (PID: 4024)

    • Loads dropped or rewritten executable

      • iexplore.exe (PID: 2412)
      • java.exe (PID: 1252)
      • javaw.exe (PID: 4024)
      • iexplore.exe (PID: 3532)

  • SUSPICIOUS

    • Executes scripts

      • cmd.exe (PID: 2120)
      • cmd.exe (PID: 2796)
      • cmd.exe (PID: 3904)
      • cmd.exe (PID: 1044)

    • Executes JAVA applets

      • javaw.exe (PID: 4024)
      • iexplore.exe (PID: 2412)

    • Creates files in the user directory

      • javaw.exe (PID: 4024)
      • xcopy.exe (PID: 2600)

    • Starts CMD.EXE for commands execution

      • javaw.exe (PID: 4024)
      • java.exe (PID: 1252)

    • Executable content was dropped or overwritten

      • xcopy.exe (PID: 2600)

  • INFO

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3532)
      • iexplore.exe (PID: 2412)

    • Changes internet zones settings

      • iexplore.exe (PID: 2412)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2412)

    • Application launched itself

      • iexplore.exe (PID: 2412)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
54
Monitored processes
14
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe javaw.exe no specs #ADWIND java.exe cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs xcopy.exe xcopy.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2412"C:\Program Files\Internet Explorer\iexplore.exe" "https://cykhardware.com/remittance.jar"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3532"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2412 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
4024"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -jar "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\VZQG1M4S\remittance[1].jar" C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe—iexplore.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Version:
8.0.920.14
1252"C:\Program Files\Java\jre1.8.0_92\bin\java.exe" -jar C:\Users\admin\AppData\Local\Temp\_0.37164561125175392002205146321065169.classC:\Program Files\Java\jre1.8.0_92\bin\java.exe
javaw.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Version:
8.0.920.14
3904cmd.exe /C cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive677771099768698678.vbsC:\Windows\system32\cmd.exe—java.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2212cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive677771099768698678.vbsC:\Windows\system32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
2120cmd.exe /C cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive6973596317010699697.vbsC:\Windows\system32\cmd.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
4072cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive6973596317010699697.vbsC:\Windows\system32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
2796cmd.exe /C cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive750038555726705310.vbsC:\Windows\system32\cmd.exe—java.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3696cscript.exe C:\Users\admin\AppData\Local\Temp\Retrive750038555726705310.vbsC:\Windows\system32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Total events
785
Read events
714
Write events
0
Delete events
0

Modification events

No data
Executable files
108
Suspicious files
11
Text files
74
Unknown types
19

Dropped files

PID
Process
Filename
Type
2412iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFDFDBF778499C172A.TMP —
MD5:—
SHA256:—
2412iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico —
MD5:—
SHA256:—
2412iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
2412iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFABC1D371BCB6F661.TMP —
MD5:—
SHA256:—
2412iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{6D4DBEBD-09FE-11EA-AB41-5254004A04AF}.dat —
MD5:—
SHA256:—
1252java.exeC:\Users\admin\AppData\Local\Temp\Retrive677771099768698678.vbs —
MD5:—
SHA256:—
4024javaw.exeC:\Users\admin\AppData\Local\Temp\Retrive6973596317010699697.vbs —
MD5:—
SHA256:—
3532iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012019111820191119\index.datdat
MD5:ED1E4C455CCAB40986E3890140301D25
SHA256:C90AA9F731029FCC6CC973D2BAADDB0F2C8AB07B5E6629F207DDD116557E2845
4024javaw.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:FCF54EBAC17E52FC8DF0AA9688FB080D
SHA256:3466EAE16C3AE266CD8639E7DABE2660EAE363CFEBA3892863BF9A8D7CE8DFCD
3532iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.datdat
MD5:317EB2413C52EE2AC98389F1F14CF28A
SHA256:74AAECA9FEB3CFE56279097F6C173253AAABB9FCCAF7C9E635D4D4EA1E588CB4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2412
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3532
iexplore.exe
103.6.245.172:443
cykhardware.com
iCore Technology Sdn Bhd
MY
unknown

DNS requests

Domain
IP
Reputation
cykhardware.com
  • 103.6.245.172
unknown
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://cykhardware.com/remittance.jar