| File name: | Bina Tegas Sdn Bhd Voucher Receipts.exe |
| Full analysis: | https://app.any.run/tasks/99190454-e8ed-4814-aa20-4d17ca79e129 |
| Verdict: | Malicious activity |
| Threats: | Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links. |
| Analysis date: | April 16, 2025, 06:29:54 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections |
| MD5: | BD77910E1CDEAD3CDD559950952536E9 |
| SHA1: | 69775EB9E64AD8E34158E5D886D3FF517FEBDE39 |
| SHA256: | E11A97236AFDE003D97440B91A471A73F59FCD2C6F40CC4DDE9F7AC57E67EE5D |
| SSDEEP: | 49152:qd9zqQR7DwtnRaeuReQwsYFQGqG1hXGiPmyod1V1OsTvh88Ossh56/s96xIQyrtr:8stEe7wcF1h2iuj1+5Tss/6/CQydOUvn |
MALICIOUS
REMCOS has been found (auto)
- Bina Tegas Sdn Bhd Voucher Receipts.exe (PID: 812)
Changes the autorun value in the registry
- IMCCPHR.exe (PID: 7996)
REMCOS mutex has been found
- IMCCPHR.exe (PID: 7996)
PHISHING has been detected (SURICATA)
- svchost.exe (PID: 2196)
SUSPICIOUS
Malware-specific behavior (creating "System.dll" in Temp)
- Bina Tegas Sdn Bhd Voucher Receipts.exe (PID: 812)
Executable content was dropped or overwritten
- Bina Tegas Sdn Bhd Voucher Receipts.exe (PID: 812)
The process creates files with name similar to system file names
- Bina Tegas Sdn Bhd Voucher Receipts.exe (PID: 812)
There is functionality for taking screenshot (YARA)
- Bina Tegas Sdn Bhd Voucher Receipts.exe (PID: 812)
Potential Corporate Privacy Violation
- IMCCPHR.exe (PID: 7996)
Connects to unusual port
- IMCCPHR.exe (PID: 7996)
INFO
The sample compiled with english language support
- Bina Tegas Sdn Bhd Voucher Receipts.exe (PID: 812)
Reads the computer name
- Bina Tegas Sdn Bhd Voucher Receipts.exe (PID: 812)
Creates files or folders in the user directory
- Bina Tegas Sdn Bhd Voucher Receipts.exe (PID: 812)
- IMCCPHR.exe (PID: 7996)
Checks supported languages
- Bina Tegas Sdn Bhd Voucher Receipts.exe (PID: 812)
Create files in a temporary directory
- Bina Tegas Sdn Bhd Voucher Receipts.exe (PID: 812)
Reads the software policy settings
- IMCCPHR.exe (PID: 7996)
Checks proxy server information
- IMCCPHR.exe (PID: 7996)
Reads security settings of Internet Explorer
- IMCCPHR.exe (PID: 7996)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | NSIS - Nullsoft Scriptable Install System (91.9) |
|---|---|---|
| .exe | | | Win32 Executable MS Visual C++ (generic) (3.3) |
| .exe | | | Win64 Executable (generic) (3) |
| .dll | | | Win32 Dynamic Link Library (generic) (0.7) |
| .exe | | | Win32 Executable (generic) (0.4) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2013:05:19 23:53:02+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 24064 |
| InitializedDataSize: | 164864 |
| UninitializedDataSize: | 1024 |
| EntryPoint: | 0x310b |
| OSVersion: | 4 |
| ImageVersion: | 6 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.1.0.0 |
| ProductVersionNumber: | 1.1.0.0 |
| FileFlagsMask: | 0x0000 |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Windows, Latin1 |
| FileVersion: | 1.1.0.0 |
| LegalCopyright: | leishmanioid valgtilforordnet |
| LegalTrademarks: | shareholder |
Total processes
133
Monitored processes
5
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 812 | "C:\Users\admin\AppData\Local\Temp\Bina Tegas Sdn Bhd Voucher Receipts.exe" | C:\Users\admin\AppData\Local\Temp\Bina Tegas Sdn Bhd Voucher Receipts.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Version: 1.1.0.0 Modules
| |||||||||||||||
| 2196 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7232 | C:\WINDOWS\system32\SppExtComObj.exe -Embedding | C:\Windows\System32\SppExtComObj.Exe | — | svchost.exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: KMS Connection Broker Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7264 | "C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent | C:\Windows\System32\slui.exe | — | SppExtComObj.Exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7996 | "C:\Users\admin\AppData\Local\Temp\Bina Tegas Sdn Bhd Voucher Receipts.exe" | C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe | Bina Tegas Sdn Bhd Voucher Receipts.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: IMCCPHR.exe Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
1 267
Read events
1 261
Write events
6
Delete events
0
Modification events
| (PID) Process: | (812) Bina Tegas Sdn Bhd Voucher Receipts.exe | Key: | HKEY_CURRENT_USER\Osa185\Uninstall\Kiksen\Byssin |
| Operation: | write | Name: | charybdian |
Value: 0 | |||
| (PID) Process: | (7996) IMCCPHR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce |
| Operation: | write | Name: | Skruplers |
Value: C:\Users\admin\AppData\Roaming\Unintervolved\Udarter.exe | |||
| (PID) Process: | (7996) IMCCPHR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Rintrulux38-8H41NM |
| Operation: | write | Name: | exepath |
Value: 3FDAA2973377A05218BE5BA65C6A9185B0865F6F7687888E417F0EB08807DB26F7FB2DEA9E91FF9C44F2407429E045006B23C2D315FF04CA8806B138314105742B20CF7C47C0E7BE595977AB4F29C2D9CDE7823AB2F8 | |||
| (PID) Process: | (7996) IMCCPHR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Rintrulux38-8H41NM |
| Operation: | write | Name: | licence |
Value: 6BE1341EAD70555FE7B658735F092116 | |||
| (PID) Process: | (7996) IMCCPHR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Rintrulux38-8H41NM |
| Operation: | write | Name: | time |
Value: | |||
| (PID) Process: | (7996) IMCCPHR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Rintrulux38-8H41NM |
| Operation: | write | Name: | UID |
Value: 164523313 | |||
Executable files
1
Suspicious files
11
Text files
4
Unknown types
1
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 812 | Bina Tegas Sdn Bhd Voucher Receipts.exe | C:\Users\admin\Persistent131\tyttebrsyltetjet\Sikkerhedsseler126\Womerah.win | — | |
MD5:— | SHA256:— | |||
| 812 | Bina Tegas Sdn Bhd Voucher Receipts.exe | C:\Users\admin\Persistent131\tyttebrsyltetjet\Sikkerhedsseler126\Appendikserne\diuresers.pou | — | |
MD5:— | SHA256:— | |||
| 812 | Bina Tegas Sdn Bhd Voucher Receipts.exe | C:\Users\admin\Persistent131\tyttebrsyltetjet\Sikkerhedsseler126\Appendikserne\noodles.and | — | |
MD5:— | SHA256:— | |||
| 812 | Bina Tegas Sdn Bhd Voucher Receipts.exe | C:\Users\admin\Persistent131\tyttebrsyltetjet\Disketteformateringernes.jpg | image | |
MD5:5E63725C26FA6C11D5170AC8372C9C91 | SHA256:24446D6BCF3AD48A3F6E001760ED2F6B1B6C0C42109E867CAA01763B143C40D7 | |||
| 812 | Bina Tegas Sdn Bhd Voucher Receipts.exe | C:\Users\admin\Persistent131\tyttebrsyltetjet\Sikkerhedsseler126\afmnstringens.txt | text | |
MD5:5EA002296B955867247DC82F618464D1 | SHA256:8603EEBD93B7BB5C9A797FA1653695FD988200CCB60D598DB69C159BFD5122A7 | |||
| 812 | Bina Tegas Sdn Bhd Voucher Receipts.exe | C:\Users\admin\Persistent131\tyttebrsyltetjet\Orthosubstituted.Tri | binary | |
MD5:90354353A98C2031171C08D51E8A120F | SHA256:096CF306A25BC73FC56997667711865F255B4F1ADB7E539486D3DED56895A8E9 | |||
| 7996 | IMCCPHR.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E573CDF4C6D731D56A665145182FD759_509F9531D34B67093963A7990D344CA7 | binary | |
MD5:7A56A50DB34048700EB4D4DA753C67BB | SHA256:9FC99331B6A6BADC05DD1182089D6951089D77DD02F3749B52B1D956C0DDFBDB | |||
| 812 | Bina Tegas Sdn Bhd Voucher Receipts.exe | C:\Users\admin\Persistent131\tyttebrsyltetjet\Sikkerhedsseler126\Appendikserne\tidernes.ind | binary | |
MD5:03212208BFD9EF241FD7A236EE6E661A | SHA256:0BA6635040D454FF4877CFF35B889F0A4296AD42F6D2130E38751E15C91ECF73 | |||
| 812 | Bina Tegas Sdn Bhd Voucher Receipts.exe | C:\Users\admin\Persistent131\tyttebrsyltetjet\Sikkerhedsseler126\Appendikserne\reblooms.ini | binary | |
MD5:335596CB616CC2EDD29DE824B92B2E82 | SHA256:3C05E02249D5A6D7A57D61EC3AAEB7B646A6F9683891193D6735572B8C45CAF0 | |||
| 7996 | IMCCPHR.exe | C:\Users\admin\AppData\Roaming\Atrulx\logs.dat | binary | |
MD5:A877D74C20F5FD19E2AA0687D6ED9890 | SHA256:279EAD9EFED1A40ABF0F118D2602AB7F1D5A0D6B9CE9A659125EDAC8E919BA50 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
26
DNS requests
18
Threats
3
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5496 | MoUsoCoreWorker.exe | GET | 200 | 23.216.77.28:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
7848 | SIHClient.exe | GET | 200 | 23.219.150.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
7848 | SIHClient.exe | GET | 200 | 23.219.150.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
7996 | IMCCPHR.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAyVRp0LO%2F899HuOUNmwbkY%3D | unknown | — | — | whitelisted |
7996 | IMCCPHR.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D | unknown | — | — | whitelisted |
7996 | IMCCPHR.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEA6isGT21L%2B%2BLXlK7gS%2BvZE%3D | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2104 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1616 | RUXIMICS.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5496 | MoUsoCoreWorker.exe | 23.216.77.28:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
3216 | svchost.exe | 172.211.123.250:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
6544 | svchost.exe | 40.126.32.136:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 2.17.190.73:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
2112 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
www.dropbox.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
7996 | IMCCPHR.exe | Potential Corporate Privacy Violation | ET INFO Dropbox.com Offsite File Backup in Use |
2196 | svchost.exe | Misc activity | ET DYN_DNS DYNAMIC_DNS Query to dynnamn .ru Domain |
2196 | svchost.exe | Possible Social Engineering Attempted | PHISHING [ANY.RUN] Suspected Phishing domain by CrossDomain ( .dynnamn .ru) |