File name:

LOP.exe

Full analysis: https://app.any.run/tasks/739fc748-1eea-44cd-b29e-dd717be910e0
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Analysis date: May 09, 2024, 01:19:45
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
remcos
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

5688D3EBDD5365C98A149D6BADEA3557

SHA1:

8D7F8657A0AB00780615910FFF7971C0CAD0F9F0

SHA256:

B6D5326FA838DB31AEB1356C380785E1438953D0FD91A54C16F517598058B172

SSDEEP:

3072:oGn3BLrjOSBOpP/ySDixvvvKNy/35ENLeab:PnJqAvKNyhENLeab

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Drops the executable file immediately after the start

      • LOP.exe (PID: 3964)
    • REMCOS has been detected

      • LOP.exe (PID: 3964)
  • SUSPICIOUS

    No suspicious indicators.
  • INFO

    • Reads the computer name

      • LOP.exe (PID: 3964)
    • Reads Environment values

      • LOP.exe (PID: 3964)
    • Reads product name

      • LOP.exe (PID: 3964)
    • Checks supported languages

      • LOP.exe (PID: 3964)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (35.8)
.exe | Win64 Executable (generic) (31.7)
.scr | Windows screen saver (15)
.dll | Win32 Dynamic Link Library (generic) (7.5)
.exe | Win32 Executable (generic) (5.1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:01:05 19:50:13+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 61440
InitializedDataSize: 28672
UninitializedDataSize: -
EntryPoint: 0xfd88
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #REMCOS lop.exe

Process information

PID
CMD
Path
Indicators
Parent process
3964"C:\Users\admin\Desktop\LOP.exe" C:\Users\admin\Desktop\LOP.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\lop.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
246
Read events
245
Write events
1
Delete events
0

Modification events

(PID) Process:(3964) LOP.exeKey:HKEY_CURRENT_USER\Software\remcos_aviywkogalafiva
Operation:writeName:EXEpath
Value:
a¼e-ñðxPœ ’+{Ø·Þ±pk2愆k¦8GX
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
9
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
224.0.0.252:5355
unknown
4
System
192.168.100.255:138
whitelisted
4
System
192.168.100.255:137
whitelisted
3964
LOP.exe
10.0.2.15:80
unknown
1088
svchost.exe
224.0.0.252:5355
unknown

DNS requests

No data

Threats

No threats detected
No debug info