Find similar analyses in TI Lookup

Analysis date (UTC): 20 January 2022, 20:39Analysis environment: Windows 7 Pro, build 7601, x86

2.ps1

MD5:FD854C4DE72CCA89BDA6EC7362CB8047

SHA1:CBC87F189AD4FE16808C3B718720852A16437A2C

SHA256:E219E04F6DDD3EA4A3C3F5DD9251D1E86EA820694246F7E73695427ECEF1E4D6

Analysis result

Threat level:Malicious activity

Tags:

ratremcoskeylogger

Full analysis:Analysis 2.ps1 (MD5: FD854C4DE72CCA89BDA6EC7362CB8047) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

REMCOS was detected

RegAsm.exe (PID: 3876)

Loads dropped or rewritten executable

powershell.exe (PID: 3052)

SUSPICIOUS

Reads the computer name

powershell.exe (PID: 3052)
RegAsm.exe (PID: 3876)

Checks supported languages

powershell.exe (PID: 3052)
RegAsm.exe (PID: 3876)

Reads the date of Windows installation

powershell.exe (PID: 3052)

PowerShell script executed

powershell.exe (PID: 3052)

Creates files in the user directory

powershell.exe (PID: 3052)
RegAsm.exe (PID: 3876)

Executable content was dropped or overwritten

powershell.exe (PID: 3052)

Drops a file that was compiled in debug mode

powershell.exe (PID: 3052)

Reads Environment values

RegAsm.exe (PID: 3876)

Writes files like Keylogger logs

RegAsm.exe (PID: 3876)

INFO

Checks Windows Trust Settings

powershell.exe (PID: 3052)

Threats

No threats detected