File name:

c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0

Full analysis: https://app.any.run/tasks/44c44dae-5861-43a5-930b-9da0d274efd0
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Analysis date: January 10, 2025, 20:50:31
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
rat
remcos
evasion
autoit
upx
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 3 sections
MD5:

BE20DFFFCBA37064D6087AA714036873

SHA1:

4F50F7F954ED27B8E3373A5D900905D98D1BB51E

SHA256:

C889443786DC57C284A40FD1A9764BAD2F026A8C20E191059707D1646FF931E0

SSDEEP:

49152:ilMd5NJ7WRR/eksMDOSAekZXoEtt0FAYQJYpZurnOMJgJYHePdiP1U42t1bVeNUF:ilgJbksMDOSlkZX36ZOYyrfo8ePdi9VQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Create files in the Startup directory

      • Milburr.exe (PID: 6808)
    • REMCOS mutex has been found

      • Milburr.exe (PID: 6936)
    • REMCOS has been detected

      • Milburr.exe (PID: 6936)
      • Milburr.exe (PID: 6936)
    • Connects to the CnC server

      • Milburr.exe (PID: 6936)
    • REMCOS has been detected (YARA)

      • Milburr.exe (PID: 6936)
    • REMCOS has been detected (SURICATA)

      • Milburr.exe (PID: 6936)
  • SUSPICIOUS

    • Starts itself from another location

      • c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe (PID: 6760)
    • Executable content was dropped or overwritten

      • c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe (PID: 6760)
    • Application launched itself

      • Milburr.exe (PID: 6808)
      • Milburr.exe (PID: 6844)
    • Reads security settings of Internet Explorer

      • Milburr.exe (PID: 6936)
    • Checks for external IP

      • Milburr.exe (PID: 6936)
    • There is functionality for taking screenshot (YARA)

      • Milburr.exe (PID: 6936)
    • Connects to unusual port

      • Milburr.exe (PID: 6936)
    • Contacting a server suspected of hosting an CnC

      • Milburr.exe (PID: 6936)
  • INFO

    • Reads mouse settings

      • c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe (PID: 6760)
      • Milburr.exe (PID: 6808)
      • Milburr.exe (PID: 6844)
      • Milburr.exe (PID: 6936)
    • Creates files or folders in the user directory

      • c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe (PID: 6760)
      • Milburr.exe (PID: 6808)
      • Milburr.exe (PID: 6936)
    • The sample compiled with english language support

      • c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe (PID: 6760)
    • Reads the machine GUID from the registry

      • c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe (PID: 6760)
    • Create files in a temporary directory

      • Milburr.exe (PID: 6808)
      • c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe (PID: 6760)
      • Milburr.exe (PID: 6936)
      • Milburr.exe (PID: 6844)
    • Checks supported languages

      • Milburr.exe (PID: 6808)
      • c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe (PID: 6760)
      • Milburr.exe (PID: 6936)
      • Milburr.exe (PID: 6844)
    • Checks proxy server information

      • Milburr.exe (PID: 6936)
    • Reads the computer name

      • Milburr.exe (PID: 6936)
    • Creates files in the program directory

      • Milburr.exe (PID: 6936)
    • UPX packer has been detected

      • Milburr.exe (PID: 6936)
    • The process uses AutoIt

      • Milburr.exe (PID: 6936)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (39.3)
.exe | Win32 EXE Yoda's Crypter (38.6)
.dll | Win32 Dynamic Link Library (generic) (9.5)
.exe | Win32 Executable (generic) (6.5)
.exe | Generic Win/DOS Executable (2.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:12:10 03:17:18+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 352256
InitializedDataSize: 569344
UninitializedDataSize: 1097728
EntryPoint: 0x162a60
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (British)
CharacterSet: Unicode
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
130
Monitored processes
4
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe milburr.exe milburr.exe no specs #REMCOS milburr.exe

Process information

PID
CMD
Path
Indicators
Parent process
6760"C:\Users\admin\AppData\Local\Temp\c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe" C:\Users\admin\AppData\Local\Temp\c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6808"C:\Users\admin\AppData\Local\Temp\c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe" C:\Users\admin\AppData\Local\obtenebrate\Milburr.exe
c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\obtenebrate\milburr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6844"C:\Users\admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\admin\AppData\Local\obtenebrate\Milburr.exeMilburr.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\obtenebrate\milburr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6936"C:\Users\admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\admin\AppData\Local\obtenebrate\Milburr.exe
Milburr.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\obtenebrate\milburr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
563
Read events
557
Write events
6
Delete events
0

Modification events

(PID) Process:(6936) Milburr.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-MKYDDH
Operation:writeName:exepath
Value:
9B8A190947C78ED6C3D9B7D534B61B849B5787C895EAFE59FDA049BD589C3F6E37AA0FC9E40CA53EFF33DE7F861481C73D6F20D87ACF5CA3A62C6EA9B87A972CE372EF1A75DA7DCE3CA636542C4AAF5CF479CCA66616F82434EE1FCBDAC027EC71F8A3FB16262353F9B3
(PID) Process:(6936) Milburr.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-MKYDDH
Operation:writeName:licence
Value:
0EB06E9879E22DB55E5768653EA77A5C
(PID) Process:(6936) Milburr.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-MKYDDH
Operation:writeName:time
Value:
(PID) Process:(6936) Milburr.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6936) Milburr.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6936) Milburr.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
1
Suspicious files
12
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
6936Milburr.exeC:\Users\admin\AppData\Local\Temp\aut6759.tmpbinary
MD5:00360588750369BC243ED68948507859
SHA256:71E5D5E454B65C35189F3CC57C5923678F53758420ABF6C3975A0E188FB8D855
6760c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exeC:\Users\admin\AppData\Local\Temp\aut5B34.tmpbinary
MD5:00360588750369BC243ED68948507859
SHA256:71E5D5E454B65C35189F3CC57C5923678F53758420ABF6C3975A0E188FB8D855
6808Milburr.exeC:\Users\admin\AppData\Local\Temp\aut5EED.tmpbinary
MD5:00360588750369BC243ED68948507859
SHA256:71E5D5E454B65C35189F3CC57C5923678F53758420ABF6C3975A0E188FB8D855
6760c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exeC:\Users\admin\AppData\Local\Temp\Charleybinary
MD5:E8F92D99524EFF3DE429C3718B7A1491
SHA256:894CB71AD99FF88B5C93218788DE1D133B4D0404D4996F7E5D3255209322F6E9
6936Milburr.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\json[1].jsonbinary
MD5:ED8C3A40578AC153219792AF4CED3D09
SHA256:B8E1A531D18E89DD6DD639133AA64D62FCAD1F8C54088DE3569A5A5804C8A70C
6844Milburr.exeC:\Users\admin\AppData\Local\Temp\aut63AF.tmpbinary
MD5:DF6CE24C1D936B4B56DCD548DEF18B8D
SHA256:FED7B359F763F28D9E01BB5F6C734A29F17A67AE34161F4053DDAC0407F52610
6808Milburr.exeC:\Users\admin\AppData\Local\Temp\aut5E9E.tmpbinary
MD5:DF6CE24C1D936B4B56DCD548DEF18B8D
SHA256:FED7B359F763F28D9E01BB5F6C734A29F17A67AE34161F4053DDAC0407F52610
6844Milburr.exeC:\Users\admin\AppData\Local\Temp\aut63FE.tmpbinary
MD5:00360588750369BC243ED68948507859
SHA256:71E5D5E454B65C35189F3CC57C5923678F53758420ABF6C3975A0E188FB8D855
6760c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exeC:\Users\admin\AppData\Local\Temp\aut5AB6.tmpbinary
MD5:DF6CE24C1D936B4B56DCD548DEF18B8D
SHA256:FED7B359F763F28D9E01BB5F6C734A29F17A67AE34161F4053DDAC0407F52610
6808Milburr.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Milburr.vbsbinary
MD5:395E4EA35B3ABF5E6A42C8610D9896E8
SHA256:E9530604D13A45C5DFC888D9F43C6FEE6F4425364922EA7825F82671E5EE54E7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
34
DNS requests
19
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4308
svchost.exe
GET
200
23.48.23.185:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
GET
200
23.48.23.185:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
4308
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
6936
Milburr.exe
GET
200
178.237.33.50:80
http://geoplugin.net/json.gp
unknown
malicious
6500
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
whitelisted
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
whitelisted
6876
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
6876
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
whitelisted
4308
svchost.exe
23.48.23.185:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
23.48.23.185:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4308
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5064
SearchApp.exe
184.86.251.4:443
www.bing.com
Akamai International B.V.
DE
whitelisted
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
whitelisted
1176
svchost.exe
40.126.32.72:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.48.23.185
  • 23.48.23.194
  • 23.48.23.178
  • 23.48.23.179
  • 23.48.23.190
  • 23.48.23.191
  • 23.48.23.177
  • 23.48.23.181
  • 23.48.23.189
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 142.250.186.110
whitelisted
www.bing.com
  • 184.86.251.4
  • 184.86.251.10
  • 184.86.251.27
  • 184.86.251.24
  • 184.86.251.25
  • 184.86.251.15
  • 184.86.251.28
  • 184.86.251.13
  • 184.86.251.8
  • 104.126.37.178
  • 104.126.37.131
  • 104.126.37.129
  • 104.126.37.154
  • 104.126.37.128
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.72
  • 40.126.32.140
  • 40.126.32.133
  • 40.126.32.68
  • 40.126.32.134
  • 20.190.160.20
  • 40.126.32.74
  • 40.126.32.136
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
geoplugin.net
  • 178.237.33.50
malicious
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted

Threats

PID
Process
Class
Message
Malware Command and Control Activity Detected
ET MALWARE Remcos 3.x Unencrypted Checkin
Malware Command and Control Activity Detected
ET MALWARE Remcos 3.x Unencrypted Checkin
Malware Command and Control Activity Detected
ET MALWARE Remcos 3.x Unencrypted Server Response
Malware Command and Control Activity Detected
ET MALWARE Remcos 3.x Unencrypted Server Response
1 ETPRO signatures available at the full report
No debug info