analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://anonfile.com/feWdPfwbbc/Slayer_RDP_Scanner_zip

Full analysis: https://app.any.run/tasks/3cd3be77-dfb2-48c4-86e2-4e2945971ef5
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: March 15, 2019, 00:42:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
remcos
keylogger
Indicators:
MD5:

C1880E16F355E67033CD991305C4BF30

SHA1:

4720AF83C7A42E138B2193E6A2C4890247032DED

SHA256:

CB09705508E65A5810EB16B0BDE20519719D89DADB0B44323CBC53E8AD254344

SSDEEP:

3:N8RGUR26AX63Gac:2g5XcG/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Slayer RDP Brute.exe (PID: 2492)
      • Slayer RDP Scanner.exe (PID: 3864)
      • Slayer RDP Brute.exe (PID: 2188)
      • Slayer RDP Scanner.exe (PID: 3232)
      • Slayer RDP Brute.exe (PID: 1228)

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 1248)

    • Detected logs from REMCOS RAT

      • Slayer RDP Scanner.exe (PID: 3232)

    • Writes to a start menu file

      • Slayer RDP Scanner.exe (PID: 3864)
      • Slayer RDP Brute.exe (PID: 2492)

    • REMCOS RAT was detected

      • Slayer RDP Scanner.exe (PID: 3232)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Slayer RDP Scanner.exe (PID: 3864)

    • Connects to unusual port

      • Slayer RDP Scanner.exe (PID: 3232)

    • Writes files like Keylogger logs

      • Slayer RDP Scanner.exe (PID: 3232)

    • Application launched itself

      • Slayer RDP Scanner.exe (PID: 3864)
      • Slayer RDP Brute.exe (PID: 2492)

    • Creates files in the user directory

      • Slayer RDP Scanner.exe (PID: 3232)
      • Slayer RDP Brute.exe (PID: 2492)
      • Slayer RDP Scanner.exe (PID: 3864)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 2860)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3192)
      • iexplore.exe (PID: 2860)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2860)

    • Changes internet zones settings

      • iexplore.exe (PID: 2860)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3192)

    • Creates files in the user directory

      • iexplore.exe (PID: 3192)
      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 3088)
      • iexplore.exe (PID: 2860)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2860)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2860)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
10
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start iexplore.exe iexplore.exe flashutil32_26_0_0_131_activex.exe no specs winrar.exe no specs searchprotocolhost.exe no specs slayer rdp scanner.exe slayer rdp brute.exe slayer rdp brute.exe no specs #REMCOS slayer rdp scanner.exe slayer rdp brute.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2860"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3192"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2860 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3088C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -EmbeddingC:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe—svchost.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe® Flash® Player Installer/Uninstaller 26.0 r0
Exit code:
0
Version:
26,0,0,131
588"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Slayer_RDP_Scanner.zip"C:\Program Files\WinRAR\WinRAR.exe—iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
1248"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe6_ Global\UsGthrCtrlFltPipeMssGthrPipe6 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
3864"C:\Users\admin\Desktop\Slayer RDP Scanner.exe" C:\Users\admin\Desktop\Slayer RDP Scanner.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
RDP BruterX
Exit code:
0
Version:
1.0.0.0
2492"C:\Users\admin\Desktop\Slayer RDP Brute.exe" C:\Users\admin\Desktop\Slayer RDP Brute.exe
explorer.exe
User:
admin
Company:
Slayer RDP Scanner
Integrity Level:
MEDIUM
Description:
Slayer RDP Scanner
Exit code:
0
Version:
1
1228"C:\Users\admin\AppData\Local\Temp\Slayer RDP Brute.exe" C:\Users\admin\AppData\Local\Temp\Slayer RDP Brute.exe—Slayer RDP Scanner.exe
User:
admin
Integrity Level:
MEDIUM
Description:
RDP BruterX
Version:
1.0.0.0
3232"C:\Users\admin\Desktop\Slayer RDP Scanner.exe" C:\Users\admin\Desktop\Slayer RDP Scanner.exe
Slayer RDP Scanner.exe
User:
admin
Integrity Level:
MEDIUM
Description:
RDP BruterX
Version:
1.0.0.0
2188"C:\Users\admin\Desktop\Slayer RDP Brute.exe" C:\Users\admin\Desktop\Slayer RDP Brute.exe—Slayer RDP Brute.exe
User:
admin
Company:
Slayer RDP Scanner
Integrity Level:
MEDIUM
Description:
Slayer RDP Scanner
Exit code:
1
Version:
1
Total events
2 092
Read events
1 733
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
13
Text files
38
Unknown types
6

Dropped files

PID
Process
Filename
Type
2860iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico —
MD5:—
SHA256:—
2860iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3192iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\Slayer_RDP_Scanner_zip[1].txt —
MD5:—
SHA256:—
3192iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BWPPCY0O\app[1].jstext
MD5:54CFC945293FF769616451BABDCE038C
SHA256:232555C7291EC261A98090DF629D525090376774A511B438074A700D65D92537
3192iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\anonfile[1].csstext
MD5:FC056343EE59A457D68F2B59CB82F0C5
SHA256:2C8C7E689A476BB3A2AA7403A2436BD1C7495484C2714B58CA7C14AF4F845EAF
3192iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BWPPCY0O\d3ud741uvs727m_cloudfront_net[1]text
MD5:839497824CBB5A94B5F661B00FABD1F4
SHA256:78DE4DFB3AE8C77D7D94B4577D30B584CA836A03B9E7036DE9043935850EE65D
3192iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\Slayer_RDP_Scanner_zip[1].htmhtml
MD5:6BD592C783EA6E90B59262D8AB3B5A82
SHA256:A3735A73BADF968A01FBF30FD9F778B72AF1FB0D702495D197BE00707D1A62C5
3192iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\shermore_info[1]text
MD5:EF683D8AF8C0FDC42A96C30FEBCF787F
SHA256:550D376240DC39D34CAA7C83F0EF26E3233F480CDDA30557A5E8AEABDC32BCE7
3192iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BWPPCY0O\logo-anonfile[1].pngimage
MD5:B02F4A2776B104D3144E3829D2A3BDA3
SHA256:A9D65E88B9F25A240E8664F636534F0B7C368DC3B491B463723860F87CA0605E
3192iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\index.datdat
MD5:09E3648C9EC6090EE2EFB3E522312B59
SHA256:A92AE9DD987D1C690E615290E1DF83E487E648BBEC21F0AA423F7C332C305539
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
38
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3192
iexplore.exe
GET
200
205.185.216.10:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
55.2 Kb
whitelisted
3192
iexplore.exe
GET
200
54.230.199.200:80
http://x.ss2.us/x.cer
US
der
1.27 Kb
whitelisted
2860
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2860
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3192
iexplore.exe
23.111.8.154:443
oss.maxcdn.com
netDNA
US
unknown
3192
iexplore.exe
151.101.2.217:443
vjs.zencdn.net
Fastly
US
suspicious
3192
iexplore.exe
104.18.39.148:443
shermore.info
Cloudflare Inc
US
shared
3192
iexplore.exe
194.32.146.60:443
anonfile.com
—
—
unknown
3192
iexplore.exe
172.217.16.136:443
www.googletagmanager.com
Google Inc.
US
suspicious
3192
iexplore.exe
172.217.18.110:443
www.google-analytics.com
Google Inc.
US
whitelisted
3192
iexplore.exe
205.185.216.10:80
www.download.windowsupdate.com
Highwinds Network Group, Inc.
US
whitelisted
3192
iexplore.exe
54.239.164.96:443
boudja.com
Amazon.com, Inc.
US
unknown
3192
iexplore.exe
54.230.199.20:443
d3ud741uvs727m.cloudfront.net
Amazon.com, Inc.
US
suspicious

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
anonfile.com
  • 194.32.146.60
  • 194.32.146.61
whitelisted
vjs.zencdn.net
  • 151.101.2.217
  • 151.101.66.217
  • 151.101.130.217
  • 151.101.194.217
whitelisted
oss.maxcdn.com
  • 23.111.8.154
whitelisted
www.googletagmanager.com
  • 172.217.16.136
whitelisted
shermore.info
  • 104.18.39.148
  • 104.18.38.148
whitelisted
d3ud741uvs727m.cloudfront.net
  • 54.230.199.20
  • 54.230.199.199
  • 54.230.199.75
  • 54.230.199.17
whitelisted
www.google-analytics.com
  • 172.217.18.110
whitelisted
boudja.com
  • 54.239.164.96
  • 54.239.164.28
  • 54.239.164.193
  • 54.239.164.214
whitelisted
x.ss2.us
  • 54.230.199.200
  • 54.230.199.209
  • 54.230.199.28
  • 54.230.199.89
whitelisted

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://anonfile.com/feWdPfwbbc/Slayer_RDP_Scanner_zip