File name:

SecuriteInfo.com.Win32.TrojanX-gen.25530.15046

Full analysis: https://app.any.run/tasks/ec115e51-f3d9-4678-9140-f067bf8be6d5
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: November 23, 2022, 08:37:41
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
remcos
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

EEF26247E1803DF85E941AF4D6051E9C

SHA1:

0354848BA69964CE1D940923FAA60B37F174D674

SHA256:

E0D3E7932DF9715D7E739474F2D4E06DC3C3BFB7BDA509C3845BD0CD06302168

SSDEEP:

49152:FGB7xiI3kyt7C8dxdhvxI5xNs4tiwZbZeALC:UBOUdhZI5xOAi2L

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • SecuriteInfo.com.Win32.TrojanX-gen.25530.15046.exe (PID: 3516)

    • Changes the autorun value in the registry

      • SecuriteInfo.com.Win32.TrojanX-gen.25530.15046.exe (PID: 3516)

    • REMCOS detected by memory dumps

      • SecuriteInfo.com.Win32.TrojanX-gen.25530.15046.exe (PID: 3744)

    • Remcos is detected

      • SecuriteInfo.com.Win32.TrojanX-gen.25530.15046.exe (PID: 3744)

  • SUSPICIOUS

    • Reads Internet Settings

      • SecuriteInfo.com.Win32.TrojanX-gen.25530.15046.exe (PID: 3516)

    • Executes PowerShell scripts

      • SecuriteInfo.com.Win32.TrojanX-gen.25530.15046.exe (PID: 3516)

    • Application launched itself

      • SecuriteInfo.com.Win32.TrojanX-gen.25530.15046.exe (PID: 3516)

    • Executable content was dropped or overwritten

      • SecuriteInfo.com.Win32.TrojanX-gen.25530.15046.exe (PID: 3516)

    • Connects to unusual port

      • SecuriteInfo.com.Win32.TrojanX-gen.25530.15046.exe (PID: 3744)

  • INFO

    • Reads the computer name

      • SecuriteInfo.com.Win32.TrojanX-gen.25530.15046.exe (PID: 3516)
      • SecuriteInfo.com.Win32.TrojanX-gen.25530.15046.exe (PID: 3744)

    • Process checks LSA protection

      • SecuriteInfo.com.Win32.TrojanX-gen.25530.15046.exe (PID: 3516)

    • Checks supported languages

      • SecuriteInfo.com.Win32.TrojanX-gen.25530.15046.exe (PID: 3516)
      • SecuriteInfo.com.Win32.TrojanX-gen.25530.15046.exe (PID: 3744)

    • Creates files in the user directory

      • SecuriteInfo.com.Win32.TrojanX-gen.25530.15046.exe (PID: 3516)

    • Reads Environment values

      • SecuriteInfo.com.Win32.TrojanX-gen.25530.15046.exe (PID: 3744)

    • Reads product name

      • SecuriteInfo.com.Win32.TrojanX-gen.25530.15046.exe (PID: 3744)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Remcos

(PID) Process(3744) SecuriteInfo.com.Win32.TrojanX-gen.25530.15046.exe
Hosts (3)185.206.225.51:18853
127.0.0.1:18853
10.16.225.165:18853
BotnetFAITH
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell3DXQC
Setup_path%APPDATA%
Copy_fileremcos.exe
Startup_valueRemcos
Hide_fileFalse
Mutex_nameRemcos-QQ9K6X
Keylog_flag0
Keylog_path%APPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%APPDATA%
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
Max_keylog_file100000
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (82.9)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 2022-Nov-23 04:13:03
FileDescription: -
FileVersion: 1.0.0.0
InternalName: BBBBHHHH.exe
LegalCopyright: -
OriginalFilename: BBBBHHHH.exe
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

DOS Header

e_magic: MZ
e_cblp: 144
e_cp: 3
e_crlc: -
e_cparhdr: 4
e_minalloc: -
e_maxalloc: 65535
e_ss: -
e_sp: 184
e_csum: -
e_ip: -
e_cs: -
e_ovno: -
e_oemid: -
e_oeminfo: -
e_lfanew: 128

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 3
TimeDateStamp: 2022-Nov-23 04:13:03
PointerToSymbolTable: -
NumberOfSymbols: -
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
8192
2381076
2381312
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
7.22474
.rsrc
2392064
16896
16896
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.654
.reloc
2416640
12
512
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
0.10191

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.2159
588
UNKNOWN
UNKNOWN
RT_VERSION
2
5.97137
1128
UNKNOWN
UNKNOWN
RT_ICON
3
5.82335
4264
UNKNOWN
UNKNOWN
RT_ICON
4
5.42424
9640
UNKNOWN
UNKNOWN
RT_ICON
32512
2.49203
48
UNKNOWN
UNKNOWN
RT_GROUP_ICON
1 (#2)
5.00112
490
UNKNOWN
UNKNOWN
RT_MANIFEST

Imports

mscoree.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start securiteinfo.com.win32.trojanx-gen.25530.15046.exe powershell.exe no specs #REMCOS securiteinfo.com.win32.trojanx-gen.25530.15046.exe

Process information

PID
CMD
Path
Indicators
Parent process
976"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwAA==C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—SecuriteInfo.com.Win32.TrojanX-gen.25530.15046.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
3516"C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.25530.15046.exe" C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.25530.15046.exe
Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\securiteinfo.com.win32.trojanx-gen.25530.15046.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3744C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.25530.15046.exeC:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.25530.15046.exe
SecuriteInfo.com.Win32.TrojanX-gen.25530.15046.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\securiteinfo.com.win32.trojanx-gen.25530.15046.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Remcos
(PID) Process(3744) SecuriteInfo.com.Win32.TrojanX-gen.25530.15046.exe
Hosts (3)185.206.225.51:18853
127.0.0.1:18853
10.16.225.165:18853
BotnetFAITH
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell3DXQC
Setup_path%APPDATA%
Copy_fileremcos.exe
Startup_valueRemcos
Hide_fileFalse
Mutex_nameRemcos-QQ9K6X
Keylog_flag0
Keylog_path%APPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%APPDATA%
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
Max_keylog_file100000
Total events
924
Read events
913
Write events
11
Delete events
0

Modification events

(PID) Process:(3516) SecuriteInfo.com.Win32.TrojanX-gen.25530.15046.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3516) SecuriteInfo.com.Win32.TrojanX-gen.25530.15046.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3516) SecuriteInfo.com.Win32.TrojanX-gen.25530.15046.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3516) SecuriteInfo.com.Win32.TrojanX-gen.25530.15046.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3516) SecuriteInfo.com.Win32.TrojanX-gen.25530.15046.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Lfguusd
Value:
"C:\Users\admin\AppData\Roaming\Aipis\Lfguusd.exe"
(PID) Process:(3744) SecuriteInfo.com.Win32.TrojanX-gen.25530.15046.exeKey:HKEY_CURRENT_USER\Software\Remcos-QQ9K6X
Operation:writeName:exepath
Value:
3955EAFFA0020E132060FE6F4B373B9A5D0274EC23C49D6D67488C22E467941380A59753989BDB2A7C73AFF9CA89EEDAEC570EA31518CA5754C5FF0198256253B469C2ADA38F5C290F5CE78C4DAC6977CDECD62673D0537BF90EF961E6B55D39209C2C4D5C5EA9F460A01FFE0E938F337463A2076FC40543AE0A48239659BB6822792367F9426D9C1C68492B73FE7191AA437EA963A7B4DCED93DA6900C22B2A0DBA9345BC67AFD4E23E
(PID) Process:(3744) SecuriteInfo.com.Win32.TrojanX-gen.25530.15046.exeKey:HKEY_CURRENT_USER\Software\Remcos-QQ9K6X
Operation:writeName:licence
Value:
23AEE9A9632B174B4C37E63303491C89
Executable files
1
Suspicious files
2
Text files
0
Unknown types
1

Dropped files

PID
Process
Filename
Type
3516SecuriteInfo.com.Win32.TrojanX-gen.25530.15046.exeC:\Users\admin\AppData\Roaming\Aipis\Lfguusd.exeexecutable
MD5:—
SHA256:—
976powershell.exeC:\Users\admin\AppData\Local\Temp\n3fueh1n.v2e.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
976powershell.exeC:\Users\admin\AppData\Local\Temp\teov4n2j.sis.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
976powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivedbf
MD5:446DD1CF97EABA21CF14D03AEBC79F27
SHA256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
9
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1656
sipnotify.exe
HEAD
200
23.205.225.13:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=132924875993280000
NL
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1656
sipnotify.exe
23.205.225.13:80
query.prod.cms.rt.microsoft.com
AKAMAI-AS
DE
unknown
3744
SecuriteInfo.com.Win32.TrojanX-gen.25530.15046.exe
185.206.225.51:18853
—
M247 Ltd
NO
malicious
3744
SecuriteInfo.com.Win32.TrojanX-gen.25530.15046.exe
10.16.225.165:18853
—
—
—
unknown
—
—
185.206.225.51:18853
—
M247 Ltd
NO
malicious
—
—
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1352
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
query.prod.cms.rt.microsoft.com
  • 23.205.225.13
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
SecuriteInfo.com.Win32.TrojanX-gen.25530.15046