File name:

Dmgpgirz.PIF

Full analysis: https://app.any.run/tasks/38ca9832-2710-402a-9652-7e7f8ec46ddf
Verdict: Malicious activity
Threats:

DBatLoader is a loader malware used for distributing payloads of different types, including WarzoneRAT and Formbook. It is employed in multi-stage attacks that usually start with a phishing email carrying a malicious attachment.

Malware Trends Tracker     >>>
Analysis date: October 05, 2023, 09:58:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
dbatloader
rat
remcos
keylogger
remote
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

FA2AE6FA2590283600C77CCCFECC1DBC

SHA1:

8DD74817990602F9B1047316EFE6E42D80F73C0C

SHA256:

C4DA29704CF4292B61B9A7BEBE9A0F1517B28FD9D3F23AA2144AEB05BDCACD48

SSDEEP:

49152:7fryRqh5LYdvvMbXQs3RSK3Zqzwetqwwb42PSWqgE54uOVN4O6oWxmAzKvAAV/pz:XBhZYd0QKRSm1XhjaLFoWxmAuvAAri

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • REMCOS has been detected (YARA)

      • colorcpl.exe (PID: 3656)

    • Drops the executable file immediately after the start

      • Dmgpgirz.PIF (PID: 3236)

    • Remcos is detected

      • colorcpl.exe (PID: 3656)

    • DBATLOADER has been detected (YARA)

      • Dmgpgirz.PIF (PID: 3236)

    • REMCOS was detected

      • colorcpl.exe (PID: 3656)

  • SUSPICIOUS

    • Reads settings of System Certificates

      • Dmgpgirz.PIF (PID: 3236)

    • Writes files like Keylogger logs

      • colorcpl.exe (PID: 3656)

    • Connects to unusual port

      • colorcpl.exe (PID: 3656)

    • Reads the Internet Settings

      • Dmgpgirz.PIF (PID: 3236)
      • colorcpl.exe (PID: 3656)

  • INFO

    • Reads the computer name

      • Dmgpgirz.PIF (PID: 3236)

    • Checks supported languages

      • Dmgpgirz.PIF (PID: 3236)

    • Checks proxy server information

      • Dmgpgirz.PIF (PID: 3236)
      • colorcpl.exe (PID: 3656)

    • Reads the machine GUID from the registry

      • Dmgpgirz.PIF (PID: 3236)

    • Creates files in the program directory

      • colorcpl.exe (PID: 3656)

    • Creates files or folders in the user directory

      • colorcpl.exe (PID: 3656)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

DBatLoader

(PID) Process(3236) Dmgpgirz.PIF
C2VtV~ŠŠ†‰PEE…„{zˆŒ{D‚Œ{Dy…ƒEz…„‚…wzUˆ{‰zSLMYFJYLFOLZOGNNG;HGGFFO<w‹Š~{S7WZ\~‰fŠgx\Ža†_cVtVb„HVtVb„IVtV6

Remcos

(PID) Process(3656) colorcpl.exe
C2 (1)ekurorem.duckdns.org:1979
BotnetEURO USD POUNDS
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-0VK52V
Keylog_flag1
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
No Malware configuration.

TRiD

.scr | Windows screen saver (55.3)
.exe | Win32 Executable (generic) (19)
.exe | Win16/32 Executable Delphi generic (8.7)
.exe | Generic Win/DOS Executable (8.4)
.exe | DOS Executable Generic (8.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:20 00:22:17+02:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 358400
InitializedDataSize: 1253376
UninitializedDataSize: -
EntryPoint: 0x58724
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
2
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #DBATLOADER dmgpgirz.pif #REMCOS colorcpl.exe

Process information

PID
CMD
Path
Indicators
Parent process
3236"C:\Users\admin\AppData\Local\Temp\Dmgpgirz.PIF" C:\Users\admin\AppData\Local\Temp\Dmgpgirz.PIF
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\dmgpgirz.pif
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
DBatLoader
(PID) Process(3236) Dmgpgirz.PIF
C2VtV~ŠŠ†‰PEE…„{zˆŒ{D‚Œ{Dy…ƒEz…„‚…wzUˆ{‰zSLMYFJYLFOLZOGNNG;HGGFFO<w‹Š~{S7WZ\~‰fŠgx\Ža†_cVtVb„HVtVb„IVtV6
3656C:\Windows\System32\colorcpl.exeC:\Windows\System32\colorcpl.exe
Dmgpgirz.PIF
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Color Control Panel
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\colorcpl.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\colorui.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
Remcos
(PID) Process(3656) colorcpl.exe
C2 (1)ekurorem.duckdns.org:1979
BotnetEURO USD POUNDS
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-0VK52V
Keylog_flag1
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
Total events
3 296
Read events
3 270
Write events
26
Delete events
0

Modification events

(PID) Process:(3236) Dmgpgirz.PIFKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\178\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3236) Dmgpgirz.PIFKey:HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\6F6F4432B6BC37F335C82D6B0C1219041C22C59A
Operation:writeName:Blob
Value:
0F000000010000002000000066484E8F1A538437B1826386C4540FC4E5EA6B1D4D3D1594D0E642B8C03C33C50300000001000000140000006F6F4432B6BC37F335C82D6B0C1219041C22C59A0200000001000000CC0000001C0000006C00000001000000000000000000000000000000010000007B00320030004300350036003300420037002D0036004100370031002D0034003700420037002D0039003800310038002D003400440046004600420033004500310035003900300033007D00000000004D006900630072006F0073006F0066007400200045006E00680061006E006300650064002000430072007900700074006F0067007200610070006800690063002000500072006F00760069006400650072002000760031002E003000000000002000000001000000230300003082031F30820207A00302010202146D26DBDCE96462D8C6C71B8C3E77F5A5373667D7300D06092A864886F70D01010B0500301F310E300C06035504080C054561727468310D300B060355040A0C0446616B65301E170D3233303932373135353632395A170D3238303932353135353632395A301F310E300C06035504080C054561727468310D300B060355040A0C0446616B6530820122300D06092A864886F70D01010105000382010F003082010A0282010100C563F0F98A8B34BF506FE322F3C2F30ED9A7F46A7CE94EACC8538AEF3F13329B9CB2CEF305F20995CA6E7DC1A3A6DC9DDF9C9C28FBBD301FDD72D45C18B9798B320D1F2002B489C2DF483BD505D3208E3305570C67041AB8CA04912A2072E36E9F39A1BFD039460ABED597D4B3C8D8EF68B4338CFE4239EFE35AF82D4D20BDF89161F792470507D5E5625AFFBDD860E4D5203864D12E40E247EA36D09DB6D60E0F344119F232425268A5DA9AAAEDDD4C0DF09BFA0EE99A9A5E1F7460AC452BC6140AD9C2A0343FD501A238B216504D9C93455A92D7460B9970AE54F0C899E5155E94C2E03E0EA8DC9A3AD2DEC04B83D5FEE5DD1EA0D3D22D9A06824DB8BD954F0203010001A3533051301D0603551D0E0416041498C394ABA698BBE7992045125078BCDDEE869E3A301F0603551D2304183016801498C394ABA698BBE7992045125078BCDDEE869E3A300F0603551D130101FF040530030101FF300D06092A864886F70D01010B050003820101000DE7587203EC5FBAED29262654A01E38EE709A574680F848C80A26F58C72F231E6FC8A90C01DC342288F6E5B85D9B85A72074957786331E2F54FD13FAEA920514004D3F167025DE5FAFE250C7F604858586C228A4A5936E25C645E6048C2B361B6F4CD3D5048B5419D4134E76F99B115A74E4D9A7FB86F2B82EBF89F3678C8DF4F01070F88922AC28419AD31FCAEE5D19CBDF7797EE87E5E1E3B9F920B88E32CD3DBF8FFA1A5AA9AF07869951ADACA3FC83653F68B0FE6B49D0531C82B9FE03C90134F839B7EC8E536D91956C79CF9D7429D11F0AC1123E9C443D2215691084ECABC5093E3376F707E136BB21B37B5E16C84A01A619CB69B0A7DAEA8B704C2A6
(PID) Process:(3236) Dmgpgirz.PIFKey:HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\6F6F4432B6BC37F335C82D6B0C1219041C22C59A
Operation:writeName:Blob
Value:
14000000010000001400000098C394ABA698BBE7992045125078BCDDEE869E3A0200000001000000CC0000001C0000006C00000001000000000000000000000000000000010000007B00320030004300350036003300420037002D0036004100370031002D0034003700420037002D0039003800310038002D003400440046004600420033004500310035003900300033007D00000000004D006900630072006F0073006F0066007400200045006E00680061006E006300650064002000430072007900700074006F0067007200610070006800690063002000500072006F00760069006400650072002000760031002E003000000000000300000001000000140000006F6F4432B6BC37F335C82D6B0C1219041C22C59A0F000000010000002000000066484E8F1A538437B1826386C4540FC4E5EA6B1D4D3D1594D0E642B8C03C33C52000000001000000230300003082031F30820207A00302010202146D26DBDCE96462D8C6C71B8C3E77F5A5373667D7300D06092A864886F70D01010B0500301F310E300C06035504080C054561727468310D300B060355040A0C0446616B65301E170D3233303932373135353632395A170D3238303932353135353632395A301F310E300C06035504080C054561727468310D300B060355040A0C0446616B6530820122300D06092A864886F70D01010105000382010F003082010A0282010100C563F0F98A8B34BF506FE322F3C2F30ED9A7F46A7CE94EACC8538AEF3F13329B9CB2CEF305F20995CA6E7DC1A3A6DC9DDF9C9C28FBBD301FDD72D45C18B9798B320D1F2002B489C2DF483BD505D3208E3305570C67041AB8CA04912A2072E36E9F39A1BFD039460ABED597D4B3C8D8EF68B4338CFE4239EFE35AF82D4D20BDF89161F792470507D5E5625AFFBDD860E4D5203864D12E40E247EA36D09DB6D60E0F344119F232425268A5DA9AAAEDDD4C0DF09BFA0EE99A9A5E1F7460AC452BC6140AD9C2A0343FD501A238B216504D9C93455A92D7460B9970AE54F0C899E5155E94C2E03E0EA8DC9A3AD2DEC04B83D5FEE5DD1EA0D3D22D9A06824DB8BD954F0203010001A3533051301D0603551D0E0416041498C394ABA698BBE7992045125078BCDDEE869E3A301F0603551D2304183016801498C394ABA698BBE7992045125078BCDDEE869E3A300F0603551D130101FF040530030101FF300D06092A864886F70D01010B050003820101000DE7587203EC5FBAED29262654A01E38EE709A574680F848C80A26F58C72F231E6FC8A90C01DC342288F6E5B85D9B85A72074957786331E2F54FD13FAEA920514004D3F167025DE5FAFE250C7F604858586C228A4A5936E25C645E6048C2B361B6F4CD3D5048B5419D4134E76F99B115A74E4D9A7FB86F2B82EBF89F3678C8DF4F01070F88922AC28419AD31FCAEE5D19CBDF7797EE87E5E1E3B9F920B88E32CD3DBF8FFA1A5AA9AF07869951ADACA3FC83653F68B0FE6B49D0531C82B9FE03C90134F839B7EC8E536D91956C79CF9D7429D11F0AC1123E9C443D2215691084ECABC5093E3376F707E136BB21B37B5E16C84A01A619CB69B0A7DAEA8B704C2A6
(PID) Process:(3656) colorcpl.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3656) colorcpl.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000053010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3656) colorcpl.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3656) colorcpl.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3656) colorcpl.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3656) colorcpl.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3656) colorcpl.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
Executable files
1
Suspicious files
2
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
3236Dmgpgirz.PIFC:\Users\Public\Libraries\Dmgpgirz.PIFexecutable
MD5:FA2AE6FA2590283600C77CCCFECC1DBC
SHA256:C4DA29704CF4292B61B9A7BEBE9A0F1517B28FD9D3F23AA2144AEB05BDCACD48
3656colorcpl.exeC:\ProgramData\remcos\logs.datbinary
MD5:0B6879C4C5A327DCC5F2C8DD8CE971A8
SHA256:2AAC885B43808B38D4FDDB0E0D7B5DD40FB0B2D716682C79A55AF6C14AFBF7EB
3656colorcpl.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\json[1].jsonbinary
MD5:C7B346B528C9BA766AA64EAD9ED7BE1C
SHA256:D63C4BAFA36E6ECE66792D7FD03E76DE1C12B3D65DF0E752D635F42061BCCA5A
3236Dmgpgirz.PIFC:\Users\Public\Dmgpgirz.urltext
MD5:7E199CCD96056A8C30B67309C680FF8D
SHA256:15A1743BA1C96FBE18FC798A521F9DD3038812DBE47431978735494292AF70E9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
9
DNS requests
5
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
178.237.33.50:80
http://geoplugin.net/json.gp
unknown
binary
953 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2656
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3236
Dmgpgirz.PIF
13.107.42.13:443
onedrive.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
3236
Dmgpgirz.PIF
13.107.42.12:443
zjikuw.am.files.1drv.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
3656
colorcpl.exe
172.94.12.73:1979
ekurorem.duckdns.org
Voxility LLP
DE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3656
colorcpl.exe
178.237.33.50:80
geoplugin.net
Schuberg Philis B.V.
NL
unknown

DNS requests

Domain
IP
Reputation
onedrive.live.com
  • 13.107.42.13
shared
zjikuw.am.files.1drv.com
  • 13.107.42.12
unknown
ekurorem.duckdns.org
  • 172.94.12.73
malicious
dns.msftncsi.com
  • 131.107.255.255
shared
geoplugin.net
  • 178.237.33.50
malicious

Threats

PID
Process
Class
Message
1088
svchost.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain
1088
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
3656
colorcpl.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x TLS Connection
3656
colorcpl.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS JA3 Hash
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Dmgpgirz.PIF