File name:

c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0

Full analysis: https://app.any.run/tasks/44c44dae-5861-43a5-930b-9da0d274efd0
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Analysis date: January 10, 2025, 20:50:31
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
rat
remcos
evasion
autoit
upx
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 3 sections
MD5:

BE20DFFFCBA37064D6087AA714036873

SHA1:

4F50F7F954ED27B8E3373A5D900905D98D1BB51E

SHA256:

C889443786DC57C284A40FD1A9764BAD2F026A8C20E191059707D1646FF931E0

SSDEEP:

49152:ilMd5NJ7WRR/eksMDOSAekZXoEtt0FAYQJYpZurnOMJgJYHePdiP1U42t1bVeNUF:ilgJbksMDOSlkZX36ZOYyrfo8ePdi9VQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Create files in the Startup directory

      • Milburr.exe (PID: 6808)
    • REMCOS mutex has been found

      • Milburr.exe (PID: 6936)
    • REMCOS has been detected

      • Milburr.exe (PID: 6936)
      • Milburr.exe (PID: 6936)
    • REMCOS has been detected (SURICATA)

      • Milburr.exe (PID: 6936)
    • REMCOS has been detected (YARA)

      • Milburr.exe (PID: 6936)
    • Connects to the CnC server

      • Milburr.exe (PID: 6936)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe (PID: 6760)
    • Starts itself from another location

      • c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe (PID: 6760)
    • Application launched itself

      • Milburr.exe (PID: 6808)
      • Milburr.exe (PID: 6844)
    • Reads security settings of Internet Explorer

      • Milburr.exe (PID: 6936)
    • There is functionality for taking screenshot (YARA)

      • Milburr.exe (PID: 6936)
    • Checks for external IP

      • Milburr.exe (PID: 6936)
    • Contacting a server suspected of hosting an CnC

      • Milburr.exe (PID: 6936)
    • Connects to unusual port

      • Milburr.exe (PID: 6936)
  • INFO

    • Creates files or folders in the user directory

      • c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe (PID: 6760)
      • Milburr.exe (PID: 6808)
      • Milburr.exe (PID: 6936)
    • Reads mouse settings

      • c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe (PID: 6760)
      • Milburr.exe (PID: 6808)
      • Milburr.exe (PID: 6844)
      • Milburr.exe (PID: 6936)
    • Reads the machine GUID from the registry

      • c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe (PID: 6760)
    • Create files in a temporary directory

      • c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe (PID: 6760)
      • Milburr.exe (PID: 6844)
      • Milburr.exe (PID: 6808)
      • Milburr.exe (PID: 6936)
    • The sample compiled with english language support

      • c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe (PID: 6760)
    • Checks supported languages

      • c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe (PID: 6760)
      • Milburr.exe (PID: 6808)
      • Milburr.exe (PID: 6844)
      • Milburr.exe (PID: 6936)
    • Reads the computer name

      • Milburr.exe (PID: 6936)
    • Checks proxy server information

      • Milburr.exe (PID: 6936)
    • UPX packer has been detected

      • Milburr.exe (PID: 6936)
    • Creates files in the program directory

      • Milburr.exe (PID: 6936)
    • The process uses AutoIt

      • Milburr.exe (PID: 6936)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (39.3)
.exe | Win32 EXE Yoda's Crypter (38.6)
.dll | Win32 Dynamic Link Library (generic) (9.5)
.exe | Win32 Executable (generic) (6.5)
.exe | Generic Win/DOS Executable (2.9)

EXIF

EXE

CharacterSet: Unicode
LanguageCode: English (British)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x0000
ProductVersionNumber: 0.0.0.0
FileVersionNumber: 0.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 5.1
ImageVersion: -
OSVersion: 5.1
EntryPoint: 0x162a60
UninitializedDataSize: 1097728
InitializedDataSize: 569344
CodeSize: 352256
LinkerVersion: 12
PEType: PE32
ImageFileCharacteristics: Executable, Large address aware, 32-bit
TimeStamp: 2024:12:10 03:17:18+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
130
Monitored processes
4
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe milburr.exe milburr.exe no specs #REMCOS milburr.exe

Process information

PID
CMD
Path
Indicators
Parent process
6760"C:\Users\admin\AppData\Local\Temp\c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe" C:\Users\admin\AppData\Local\Temp\c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6808"C:\Users\admin\AppData\Local\Temp\c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe" C:\Users\admin\AppData\Local\obtenebrate\Milburr.exe
c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\obtenebrate\milburr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6844"C:\Users\admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\admin\AppData\Local\obtenebrate\Milburr.exeMilburr.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\obtenebrate\milburr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6936"C:\Users\admin\AppData\Local\obtenebrate\Milburr.exe"C:\Users\admin\AppData\Local\obtenebrate\Milburr.exe
Milburr.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\obtenebrate\milburr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
563
Read events
557
Write events
6
Delete events
0

Modification events

(PID) Process:(6936) Milburr.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-MKYDDH
Operation:writeName:exepath
Value:
9B8A190947C78ED6C3D9B7D534B61B849B5787C895EAFE59FDA049BD589C3F6E37AA0FC9E40CA53EFF33DE7F861481C73D6F20D87ACF5CA3A62C6EA9B87A972CE372EF1A75DA7DCE3CA636542C4AAF5CF479CCA66616F82434EE1FCBDAC027EC71F8A3FB16262353F9B3
(PID) Process:(6936) Milburr.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-MKYDDH
Operation:writeName:licence
Value:
0EB06E9879E22DB55E5768653EA77A5C
(PID) Process:(6936) Milburr.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-MKYDDH
Operation:writeName:time
Value:
(PID) Process:(6936) Milburr.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6936) Milburr.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6936) Milburr.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
1
Suspicious files
12
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
6760c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exeC:\Users\admin\AppData\Local\Temp\aut5B34.tmpbinary
MD5:00360588750369BC243ED68948507859
SHA256:71E5D5E454B65C35189F3CC57C5923678F53758420ABF6C3975A0E188FB8D855
6808Milburr.exeC:\Users\admin\AppData\Local\Temp\aut5EED.tmpbinary
MD5:00360588750369BC243ED68948507859
SHA256:71E5D5E454B65C35189F3CC57C5923678F53758420ABF6C3975A0E188FB8D855
6936Milburr.exeC:\Users\admin\AppData\Local\Temp\aut66EB.tmpbinary
MD5:DF6CE24C1D936B4B56DCD548DEF18B8D
SHA256:FED7B359F763F28D9E01BB5F6C734A29F17A67AE34161F4053DDAC0407F52610
6844Milburr.exeC:\Users\admin\AppData\Local\Temp\aut63AF.tmpbinary
MD5:DF6CE24C1D936B4B56DCD548DEF18B8D
SHA256:FED7B359F763F28D9E01BB5F6C734A29F17A67AE34161F4053DDAC0407F52610
6760c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exeC:\Users\admin\AppData\Local\Temp\aut5AB6.tmpbinary
MD5:DF6CE24C1D936B4B56DCD548DEF18B8D
SHA256:FED7B359F763F28D9E01BB5F6C734A29F17A67AE34161F4053DDAC0407F52610
6936Milburr.exeC:\Users\admin\AppData\Local\Temp\aut6759.tmpbinary
MD5:00360588750369BC243ED68948507859
SHA256:71E5D5E454B65C35189F3CC57C5923678F53758420ABF6C3975A0E188FB8D855
6936Milburr.exeC:\ProgramData\remcos\logs.datbinary
MD5:B46AB9F9C9A08CE62992186ACFA961C4
SHA256:860B326BF13F3471AB7380F0B6060BF23AAD1E066358D7BAE425A5F708142F24
6760c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exeC:\Users\admin\AppData\Local\obtenebrate\Milburr.exeexecutable
MD5:BE20DFFFCBA37064D6087AA714036873
SHA256:C889443786DC57C284A40FD1A9764BAD2F026A8C20E191059707D1646FF931E0
6936Milburr.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\json[1].jsonbinary
MD5:ED8C3A40578AC153219792AF4CED3D09
SHA256:B8E1A531D18E89DD6DD639133AA64D62FCAD1F8C54088DE3569A5A5804C8A70C
6760c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exeC:\Users\admin\AppData\Local\Temp\teertext
MD5:B98EE815FE928B457A8CA6290CA38293
SHA256:D1DE55CC4B804A902CD9ECBC8C4658586A9B85D4A26F147E49CA17406EBE5C6B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
34
DNS requests
19
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6876
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
6876
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
4308
svchost.exe
GET
200
23.48.23.185:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
GET
200
23.48.23.185:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
4308
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
6936
Milburr.exe
GET
200
178.237.33.50:80
http://geoplugin.net/json.gp
unknown
malicious
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
whitelisted
6500
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
whitelisted
4308
svchost.exe
23.48.23.185:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
23.48.23.185:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4308
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5064
SearchApp.exe
184.86.251.4:443
www.bing.com
Akamai International B.V.
DE
whitelisted
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
whitelisted
1176
svchost.exe
40.126.32.72:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.48.23.185
  • 23.48.23.194
  • 23.48.23.178
  • 23.48.23.179
  • 23.48.23.190
  • 23.48.23.191
  • 23.48.23.177
  • 23.48.23.181
  • 23.48.23.189
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 142.250.186.110
whitelisted
www.bing.com
  • 184.86.251.4
  • 184.86.251.10
  • 184.86.251.27
  • 184.86.251.24
  • 184.86.251.25
  • 184.86.251.15
  • 184.86.251.28
  • 184.86.251.13
  • 184.86.251.8
  • 104.126.37.178
  • 104.126.37.131
  • 104.126.37.129
  • 104.126.37.154
  • 104.126.37.128
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.72
  • 40.126.32.140
  • 40.126.32.133
  • 40.126.32.68
  • 40.126.32.134
  • 20.190.160.20
  • 40.126.32.74
  • 40.126.32.136
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
geoplugin.net
  • 178.237.33.50
malicious
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted

Threats

PID
Process
Class
Message
Malware Command and Control Activity Detected
ET MALWARE Remcos 3.x Unencrypted Checkin
Malware Command and Control Activity Detected
ET MALWARE Remcos 3.x Unencrypted Checkin
Malware Command and Control Activity Detected
ET MALWARE Remcos 3.x Unencrypted Server Response
1 ETPRO signatures available at the full report
No debug info