| File name: | FACTURA POR PAGAR CANCELE SU DEUDA DE LO CONTRARIO ABRAN ACCIONES LEGALES Y JUDICIALES.REV |
| Full analysis: | https://app.any.run/tasks/f88ae7ac-5168-49b4-9671-c2da5034a9ea |
| Verdict: | Malicious activity |
| Threats: | A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools. |
| Analysis date: | July 04, 2024, 23:02:41 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-rar |
| File info: | RAR archive data, flags: Locked EncryptedBlockHeader |
| MD5: | 41B45434AB4EEBC4CEF17B48D46C8061 |
| SHA1: | CBDA4D24D7EFC1EA1A3D60D85B54E575234E9263 |
| SHA256: | DB3D5FDA61695B664FBC4A8CD0C67BC8BAED20D6306940834BCC4D535DC75378 |
| SSDEEP: | 98304:y14nz8LHKi750saug8rvLx19AwpofGkXgp0/Le8E0rCAXX6vdV0Y7uVvcXZ53cYI:nJDx |
| .rar | | | RAR compressed archive (v-4.x) (58.3) |
|---|---|---|
| .rar | | | RAR compressed archive (gen) (41.6) |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2732 | "C:\Users\admin\AppData\Local\Temp\Rar$EXb3400.49204\FACTURA POR PAGAR CANCELE SU DEUDA DE LO CONTRARIO ABRAN ACCIONES LEGALES Y JUDICIALES.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXb3400.49204\FACTURA POR PAGAR CANCELE SU DEUDA DE LO CONTRARIO ABRAN ACCIONES LEGALES Y JUDICIALES.exe | FACTURA POR PAGAR CANCELE SU DEUDA DE LO CONTRARIO ABRAN ACCIONES LEGALES Y JUDICIALES.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: 2707spapoolfd0407 Version: 1.0.0.0 Modules
Remcos(PID) Process(2732) FACTURA POR PAGAR CANCELE SU DEUDA DE LO CONTRARIO ABRAN ACCIONES LEGALES Y JUDICIALES.exe C2 (1)areaseguras.con-ip.com:2707 Botnetspacolombia2707 Options Connect_interval1 Install_flagFalse Install_HKCU\RunTrue Install_HKLM\RunTrue Install_HKLM\Explorer\Run1 Install_HKLM\Winlogon\Shell100000 Setup_path%LOCALAPPDATA% Copy_fileremcos.exe Startup_valueTrue Hide_fileFalse Mutex_nameRmc12145501-89YHUH Keylog_flag1 Keylog_path%APPDATA% Keylog_filelogs.dat Keylog_cryptFalse Hide_keylogFalse Screenshot_flagFalse Screenshot_time5 Take_ScreenshotFalse Screenshot_path%APPDATA% Screenshot_fileScreenshots Screenshot_cryptFalse Mouse_optionFalse Delete_fileFalse Audio_record_time5 Audio_path%ProgramFiles% Audio_dirMicRecords Connect_delay0 Copy_dirRemcos Keylog_dirloggsd | |||||||||||||||
| 3272 | "C:\Users\admin\AppData\Local\Temp\Rar$EXb3400.49204\FACTURA POR PAGAR CANCELE SU DEUDA DE LO CONTRARIO ABRAN ACCIONES LEGALES Y JUDICIALES.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXb3400.49204\FACTURA POR PAGAR CANCELE SU DEUDA DE LO CONTRARIO ABRAN ACCIONES LEGALES Y JUDICIALES.exe | WinRAR.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: 2707spapoolfd0407 Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 3400 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\FACTURA POR PAGAR CANCELE SU DEUDA DE LO CONTRARIO ABRAN ACCIONES LEGALES Y JUDICIALES.REV.rar" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
| (PID) Process: | (3400) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (3400) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (3400) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (3400) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface |
| Operation: | write | Name: | ShowPassword |
Value: 0 | |||
| (PID) Process: | (3400) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\phacker.zip | |||
| (PID) Process: | (3400) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
| (PID) Process: | (3400) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip | |||
| (PID) Process: | (3400) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\FACTURA POR PAGAR CANCELE SU DEUDA DE LO CONTRARIO ABRAN ACCIONES LEGALES Y JUDICIALES.REV.rar | |||
| (PID) Process: | (3400) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (3400) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3400 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXb3400.49204\FACTURA POR PAGAR CANCELE SU DEUDA DE LO CONTRARIO ABRAN ACCIONES LEGALES Y JUDICIALES.exe | executable | |
MD5:8D2AC6A59A4B6B9D755F3966CEE3C1C9 | SHA256:4B1D3D8FBBE1E18EE7BC7EB899D446141FC4B5C9A14B534B76B916E934A329B5 | |||
| 3400 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\FACTURA POR PAGAR CANCELE SU DEUDA DE LO CONTRARIO ABRAN ACCIONES LEGALES Y JUDICIALES.REV\FACTURA POR PAGAR CANCELE SU DEUDA DE LO CONTRARIO ABRAN ACCIONES LEGALES Y JUDICIALES.exe | executable | |
MD5:8D2AC6A59A4B6B9D755F3966CEE3C1C9 | SHA256:4B1D3D8FBBE1E18EE7BC7EB899D446141FC4B5C9A14B534B76B916E934A329B5 | |||
| 2732 | FACTURA POR PAGAR CANCELE SU DEUDA DE LO CONTRARIO ABRAN ACCIONES LEGALES Y JUDICIALES.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\json[1].json | binary | |
MD5:D4AE5A1229EB67B98B2946CD5B06F7F7 | SHA256:409C26FE5879053C1C65B277953D9C29B0FFEB3BD797DEEB5ED884EE3262CAB8 | |||
| 2732 | FACTURA POR PAGAR CANCELE SU DEUDA DE LO CONTRARIO ABRAN ACCIONES LEGALES Y JUDICIALES.exe | C:\Users\admin\AppData\Roaming\loggsd\logs.dat | binary | |
MD5:F757D102DF55F20C3B1BA817B0E6CB4E | SHA256:546296D8F98DAC6CC5CB72956A0DB8B5235C64371A82DB8ECFC2CE8D8AEB3EFC | |||
| 3272 | FACTURA POR PAGAR CANCELE SU DEUDA DE LO CONTRARIO ABRAN ACCIONES LEGALES Y JUDICIALES.exe | C:\Users\admin\AppData\Roaming\Wlinlkqbc.exe | executable | |
MD5:8D2AC6A59A4B6B9D755F3966CEE3C1C9 | SHA256:4B1D3D8FBBE1E18EE7BC7EB899D446141FC4B5C9A14B534B76B916E934A329B5 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 304 | 199.232.214.172:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?33775f6043c93e33 | unknown | — | — | unknown |
2732 | FACTURA POR PAGAR CANCELE SU DEUDA DE LO CONTRARIO ABRAN ACCIONES LEGALES Y JUDICIALES.exe | GET | 200 | 178.237.33.50:80 | http://geoplugin.net/json.gp | unknown | — | — | unknown |
1372 | svchost.exe | GET | 200 | 23.48.23.143:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | unknown |
1060 | svchost.exe | GET | 304 | 199.232.214.172:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8f69642324cc87bd | unknown | — | — | unknown |
1372 | svchost.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1372 | svchost.exe | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
1060 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2732 | FACTURA POR PAGAR CANCELE SU DEUDA DE LO CONTRARIO ABRAN ACCIONES LEGALES Y JUDICIALES.exe | 86.104.72.183:2707 | areaseguras.con-ip.com | Mouk, LLC | CA | unknown |
1372 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1372 | svchost.exe | 199.232.214.172:80 | ctldl.windowsupdate.com | FASTLY | US | unknown |
2732 | FACTURA POR PAGAR CANCELE SU DEUDA DE LO CONTRARIO ABRAN ACCIONES LEGALES Y JUDICIALES.exe | 178.237.33.50:80 | geoplugin.net | Schuberg Philis B.V. | NL | unknown |
1372 | svchost.exe | 23.48.23.143:80 | crl.microsoft.com | Akamai International B.V. | DE | unknown |
1372 | svchost.exe | 95.101.149.131:80 | www.microsoft.com | Akamai International B.V. | NL | unknown |
Domain | IP | Reputation |
|---|---|---|
areaseguras.con-ip.com |
| malicious |
settings-win.data.microsoft.com |
| whitelisted |
ctldl.windowsupdate.com |
| whitelisted |
geoplugin.net |
| malicious |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
1060 | svchost.exe | Potentially Bad Traffic | ET INFO DNS Redirection Service Domain in DNS Lookup (con-ip .com) |
2732 | FACTURA POR PAGAR CANCELE SU DEUDA DE LO CONTRARIO ABRAN ACCIONES LEGALES Y JUDICIALES.exe | A Network Trojan was detected | REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash |
2732 | FACTURA POR PAGAR CANCELE SU DEUDA DE LO CONTRARIO ABRAN ACCIONES LEGALES Y JUDICIALES.exe | Malware Command and Control Activity Detected | ET JA3 Hash - Remcos 3.x/4.x TLS Connection |