File name:

cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exe

Full analysis: https://app.any.run/tasks/d8b5bbef-bacb-42b4-aa16-b7a760e2f5ed
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: May 18, 2025, 13:16:16
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
netreactor
remcos
rat
remote
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

96F10620A4CC02880B10DCBD595F0B6F

SHA1:

D0636597348FA7D2475ECE831D7D6A61F440987F

SHA256:

CB4EAAF210FFFB0DE8A0794D950DBBF9C4A688F968CEF0EA117680FF0450B39A

SSDEEP:

49152:yQoL8vsdeq5n/II7p4KVNin1bwwRkDL1yWxZMRt7RDg+Y/wkJihiN/0pNOccvF1E:hCHnvaeteVRU+lkJ4a/0p0DFzCLbop23

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • REMCOS mutex has been found

      • cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exe (PID: 2364)

    • REMCOS has been detected

      • cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exe (PID: 2364)
      • cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exe (PID: 2364)

    • REMCOS has been detected (SURICATA)

      • cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exe (PID: 2364)

    • REMCOS has been detected (YARA)

      • cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exe (PID: 2364)

  • SUSPICIOUS

    • Application launched itself

      • cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exe (PID: 2840)

    • Connects to unusual port

      • cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exe (PID: 2364)

    • There is functionality for taking screenshot (YARA)

      • cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exe (PID: 2364)

    • Contacting a server suspected of hosting an CnC

      • cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exe (PID: 2364)

    • Reads the Internet Settings

      • cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exe (PID: 2364)

    • Reads security settings of Internet Explorer

      • cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exe (PID: 2364)

  • INFO

    • Reads Environment values

      • cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exe (PID: 2364)

    • Checks supported languages

      • cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exe (PID: 2840)
      • cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exe (PID: 2364)

    • Reads the computer name

      • cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exe (PID: 2840)
      • cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exe (PID: 2364)

    • .NET Reactor protector has been detected

      • cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exe (PID: 2840)

    • Reads the machine GUID from the registry

      • cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exe (PID: 2840)
      • cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exe (PID: 2364)

    • Reads product name

      • cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exe (PID: 2364)

    • Creates files in the program directory

      • cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exe (PID: 2364)

    • Checks proxy server information

      • cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exe (PID: 2364)

    • Creates files or folders in the user directory

      • cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exe (PID: 2364)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Remcos

(PID) Process(2364) cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exe
C2 (3)127.0.0.1:61033
ikechukwu.duckdns.org:61033
196.251.92.58:61033
BotnetRemoteHost
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueRemcos
Hide_fileFalse
Mutex_nameRmc-C1LTB1
Keylog_flag1
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
Max_keylog_file100000
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (82.9)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2040:01:23 20:44:28+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 934912
InitializedDataSize: 9216
UninitializedDataSize: -
EntryPoint: 0xe63ae
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 3.5.2240.18
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: 智能图书编目系统，具备阅读分析功能。
CompanyName: 博典创新科技
FileDescription: 亚历山大学者版
FileVersion: 3.5.2240.18
InternalName: jesY.exe
LegalCopyright: © 博典创新科技 二零二五年
LegalTrademarks: 亚历山大™ • 学者版
OriginalFileName: jesY.exe
ProductName: 亚历山大
ProductVersion: 亚历山大.学者版.第三卷
AssemblyVersion: 3.5.2240.18
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exe no specs #REMCOS cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
1080C:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2364"C:\Users\admin\Downloads\cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exe"C:\Users\admin\Downloads\cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exe
cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exe
User:
admin
Company:
博典创新科技
Integrity Level:
MEDIUM
Description:
亚历山大学者版
Version:
3.5.2240.18
Modules
Images
c:\users\admin\downloads\cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Remcos
(PID) Process(2364) cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exe
C2 (3)127.0.0.1:61033
ikechukwu.duckdns.org:61033
196.251.92.58:61033
BotnetRemoteHost
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueRemcos
Hide_fileFalse
Mutex_nameRmc-C1LTB1
Keylog_flag1
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
Max_keylog_file100000
2840"C:\Users\admin\Downloads\cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exe" C:\Users\admin\Downloads\cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exe—explorer.exe
User:
admin
Company:
博典创新科技
Integrity Level:
MEDIUM
Description:
亚历山大学者版
Exit code:
0
Version:
3.5.2240.18
Modules
Images
c:\users\admin\downloads\cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
1 471
Read events
1 437
Write events
28
Delete events
6

Modification events

(PID) Process:(1080) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Nla\Cache\Intranet
Operation:writeName:{4040CF00-1B3E-486A-B407-FA14C56B6FC0}
Value:
D4DA6D3E3157
(PID) Process:(2364) cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exeKey:HKEY_CURRENT_USER\Software\Rmc-C1LTB1
Operation:writeName:exepath
Value:
F7A422329E4AA9C6AAC3C5E2D44531A3FD6DB3C85642C869A7CCF4068F9911C03A4796BBA25391655D50F1178F78739B97C11119315025AE248F6D27230685DD0BBEA2B8CD4B3E95EF034D7FC31ED48AC3ED17F6F9DF361CAB1B71211B7AA150B0E2628FB03EAD5C96EF2EEB4C8AD6B6EF9677CA4E3EF3B4E0E4A3F422B1E89557D4CAFB59ECA4546EF8A72C722B7FE818E719F4D901DB6B0340367852B41C707B71AA2BF6EF940D552D4B5D1BE757E0A7DD6334FA90DB160981DF433294FEEF
(PID) Process:(2364) cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exeKey:HKEY_CURRENT_USER\Software\Rmc-C1LTB1
Operation:writeName:licence
Value:
E598757265493FB13F93A2821D0EEA47
(PID) Process:(2364) cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2364) cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2364) cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2364) cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2364) cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2364) cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EAF6A73E-F196-4EB5-8241-9854B2974F61}
Operation:writeName:WpadDecisionReason
Value:
1
(PID) Process:(2364) cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EAF6A73E-F196-4EB5-8241-9854B2974F61}
Operation:writeName:WpadDecisionTime
Value:
62211624F7C7DB01
Executable files
0
Suspicious files
2
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2364cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\json[1].jsonbinary
MD5:C8C7844BDB03C49C94ED8F103310D155
SHA256:41D544970ABAC340AA1FDC9D43C9A5C3387CD90B698A7AE7CEC499F6AA6F3816
2364cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exeC:\ProgramData\remcos\logs.datbinary
MD5:CB993FF37CDB017856E0302D541B673C
SHA256:1453DBBD3135FD4ED84C0C8354D907F913E23F1D1F14663FFCB99DA52B4E0363
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
9
DNS requests
3
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2364
cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exe
GET
200
178.237.33.50:80
http://geoplugin.net/json.gp
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2364
cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exe
197.210.71.65:61033
ikechukwu.duckdns.org
MTN NIGERIA Communication limited
NG
unknown
2364
cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exe
196.251.92.58:61033
—
—
ZA
malicious
2364
cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exe
178.237.33.50:80
geoplugin.net
Schuberg Philis B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.78
whitelisted
ikechukwu.duckdns.org
  • 197.210.71.65
unknown
geoplugin.net
  • 178.237.33.50
whitelisted

Threats

PID
Process
Class
Message
1080
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain
1080
svchost.exe
Misc activity
ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain
2364
cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
2364
cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
cb4eaaf210fffb0de8a0794d950dbbf9c4a688f968cef0ea117680ff0450b39a_1.exe