File name:

e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe

Full analysis: https://app.any.run/tasks/693ff265-0510-4fcb-9993-f2075482c3c1
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Analysis date: March 25, 2025, 03:35:20
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
rat
remcos
remote
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

F84CA85C72B7E1DBA1896FCB85E2ECF1

SHA1:

0A253FE4FFF7E3C7A52AB24AE5BF5B9A823C376F

SHA256:

E6B6CB1272025F0A6857CE9CFA7CC6CB5A170F9E9C7C4BE351CD56A5C6D777BE

SSDEEP:

49152:feai7BarKQeZWByvoWBTFiF3Ovx/MBciGsdIzzsy9NKzEwLQbeZwjlHeIsvp:carKQCoWBTYF32/fiG2I8y9kzJLQF83p

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Executing a file with an untrusted certificate

      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 5244)
      • remcos.exe (PID: 5800)
      • remcos.exe (PID: 7148)
    • REMCOS mutex has been found

      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 5244)
      • remcos.exe (PID: 7148)
    • REMCOS has been detected

      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 5244)
      • remcos.exe (PID: 7148)
    • Changes the autorun value in the registry

      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 5244)
      • remcos.exe (PID: 7148)
    • REMCOS has been detected (SURICATA)

      • remcos.exe (PID: 7148)
    • Steals credentials from Web Browsers

      • recover.exe (PID: 1040)
    • Actions looks like stealing of personal data

      • recover.exe (PID: 2552)
      • recover.exe (PID: 2040)
      • recover.exe (PID: 1040)
  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 2320)
      • remcos.exe (PID: 5800)
    • Malware-specific behavior (creating "System.dll" in Temp)

      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 2320)
      • remcos.exe (PID: 5800)
    • Executable content was dropped or overwritten

      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 2320)
      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 5244)
      • remcos.exe (PID: 5800)
    • There is functionality for taking screenshot (YARA)

      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 2320)
      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 5244)
      • remcos.exe (PID: 5800)
      • remcos.exe (PID: 7148)
    • Application launched itself

      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 2320)
      • remcos.exe (PID: 5800)
    • Reads security settings of Internet Explorer

      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 5244)
      • remcos.exe (PID: 7148)
    • Starts itself from another location

      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 5244)
    • Connects to unusual port

      • remcos.exe (PID: 7148)
    • Contacting a server suspected of hosting an CnC

      • remcos.exe (PID: 7148)
  • INFO

    • Creates files or folders in the user directory

      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 2320)
      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 5244)
      • remcos.exe (PID: 7148)
    • Reads the computer name

      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 2320)
      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 5244)
      • remcos.exe (PID: 5800)
      • remcos.exe (PID: 7148)
    • Checks supported languages

      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 2320)
      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 5244)
      • remcos.exe (PID: 5800)
      • remcos.exe (PID: 7148)
    • The sample compiled with english language support

      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 2320)
      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 5244)
    • Create files in a temporary directory

      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 2320)
      • remcos.exe (PID: 5800)
      • recover.exe (PID: 1040)
      • recover.exe (PID: 2552)
      • recover.exe (PID: 2040)
    • Reads the software policy settings

      • slui.exe (PID: 5512)
      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 5244)
      • remcos.exe (PID: 7148)
      • slui.exe (PID: 5968)
    • Reads the machine GUID from the registry

      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 5244)
      • remcos.exe (PID: 7148)
    • Checks proxy server information

      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 5244)
      • remcos.exe (PID: 7148)
      • slui.exe (PID: 5968)
    • Process checks computer location settings

      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 5244)
    • Creates files in the program directory

      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 5244)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:12:15 22:24:07+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 25600
InitializedDataSize: 3805696
UninitializedDataSize: 2048
EntryPoint: 0x336c
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.2.0.0
ProductVersionNumber: 2.2.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Mail-Well Inc.
FileDescription: Energizer Holdings Inc.
FileVersion: 2.2.0.0
InternalName: staalorm.exe
ProductName: Xamasoft
ProductVersion: 2.2.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
142
Monitored processes
10
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe sppextcomobj.exe no specs slui.exe #REMCOS e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe slui.exe remcos.exe #REMCOS remcos.exe recover.exe recover.exe recover.exe

Process information

PID
CMD
Path
Indicators
Parent process
1040C:\Windows\SysWOW64\recover.exe /stext "C:\Users\admin\AppData\Local\Temp\tpnmectugpl"C:\Windows\SysWOW64\recover.exe
remcos.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Recover Files Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\recover.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2040C:\Windows\SysWOW64\recover.exe /stext "C:\Users\admin\AppData\Local\Temp\glgygfoqifvkqvqahj"C:\Windows\SysWOW64\recover.exe
remcos.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Recover Files Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\recover.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2320"C:\Users\admin\Desktop\e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe" C:\Users\admin\Desktop\e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe
explorer.exe
User:
admin
Company:
Mail-Well Inc.
Integrity Level:
MEDIUM
Description:
Energizer Holdings Inc.
Exit code:
0
Version:
2.2.0.0
Modules
Images
c:\users\admin\desktop\e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2552C:\Windows\SysWOW64\recover.exe /stext "C:\Users\admin\AppData\Local\Temp\wraffmewuxdfnp"C:\Windows\SysWOW64\recover.exe
remcos.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Recover Files Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\recover.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5244"C:\Users\admin\Desktop\e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe" C:\Users\admin\Desktop\e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe
e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe
User:
admin
Company:
Mail-Well Inc.
Integrity Level:
MEDIUM
Description:
Energizer Holdings Inc.
Exit code:
0
Version:
2.2.0.0
Modules
Images
c:\windows\syswow64\mshtml.dll
c:\users\admin\desktop\e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5512"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5800"C:\ProgramData\Remcos\remcos.exe" C:\ProgramData\Remcos\remcos.exe
e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe
User:
admin
Company:
Mail-Well Inc.
Integrity Level:
MEDIUM
Description:
Energizer Holdings Inc.
Exit code:
0
Version:
2.2.0.0
Modules
Images
c:\programdata\remcos\remcos.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5968C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6372C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exesvchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7148"C:\ProgramData\Remcos\remcos.exe" C:\ProgramData\Remcos\remcos.exe
remcos.exe
User:
admin
Company:
Mail-Well Inc.
Integrity Level:
MEDIUM
Description:
Energizer Holdings Inc.
Version:
2.2.0.0
Modules
Images
c:\windows\syswow64\mshtml.dll
c:\programdata\remcos\remcos.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
3 352
Read events
3 331
Write events
21
Delete events
0

Modification events

(PID) Process:(2320) e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\CLR\Start
Operation:writeName:CLR Start
Value:
2
(PID) Process:(2320) e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exeKey:HKEY_CURRENT_USER\SOFTWARE\Service
Operation:writeName:System_Check
Value:
kernel32::CreateFileA(m r4 , i 0x80000000, i 0, p 0, i 4, i 0x80, i 0)i.r5
(PID) Process:(2320) e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exeKey:HKEY_CURRENT_USER\SOFTWARE\Service
Operation:writeName:System_Check
Value:
kernel32::SetFilePointer(i r5, i 13101 , i 0,i 0)
(PID) Process:(2320) e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exeKey:HKEY_CURRENT_USER\SOFTWARE\Service
Operation:writeName:System_Check
Value:
kernel32::VirtualAlloc(i 0,i 64532480, i 0x3000, i 0x40)p.r2
(PID) Process:(2320) e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exeKey:HKEY_CURRENT_USER\SOFTWARE\Service
Operation:writeName:System_Check
Value:
kernel32::ReadFile(i r5, i r2, i 64532480,*i 0, i 0)
(PID) Process:(2320) e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exeKey:HKEY_CURRENT_USER\SOFTWARE\Service
Operation:writeName:System_Check
Value:
user32::EnumWindows(i r2 ,i 0)
(PID) Process:(5800) remcos.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\CLR\Start
Operation:writeName:CLR Start
Value:
2
(PID) Process:(5800) remcos.exeKey:HKEY_CURRENT_USER\SOFTWARE\Service
Operation:writeName:System_Check
Value:
kernel32::CreateFileA(m r4 , i 0x80000000, i 0, p 0, i 4, i 0x80, i 0)i.r5
(PID) Process:(5800) remcos.exeKey:HKEY_CURRENT_USER\SOFTWARE\Service
Operation:writeName:System_Check
Value:
kernel32::SetFilePointer(i r5, i 13101 , i 0,i 0)
(PID) Process:(5800) remcos.exeKey:HKEY_CURRENT_USER\SOFTWARE\Service
Operation:writeName:System_Check
Value:
kernel32::VirtualAlloc(i 0,i 64532480, i 0x3000, i 0x40)p.r2
Executable files
3
Suspicious files
15
Text files
14
Unknown types
0

Dropped files

PID
Process
Filename
Type
2320e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\demokratiers\Whelpling\electrotonus.she
MD5:
SHA256:
2320e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\demokratiers\Whelpling\fatherkin.def
MD5:
SHA256:
2320e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\demokratiers\Whelpling\branddrjt.Pla82binary
MD5:39CD816346D600A454C60BB2E088612D
SHA256:4E92F70445B10B7BC817E85E5679F352751353F369A27C9C68D4DB2749F78E44
2320e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\demokratiers\Whelpling\Anaphe.Brebinary
MD5:1AAB0E209D9B75E0D882A8789B204619
SHA256:DEE0ABC203383206DA55D6B9BC10A687AFA9563EEA3EFC4AD6B76C99E85F8CFF
2320e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\demokratiers\Whelpling\Arbejdskampes.jpgimage
MD5:6084ED1962644967BFB0F96646B9B0DD
SHA256:F92C6D1043CB0617E99CBF304F86DC6DEB3DE5F27C62EB58E49744F35E2126C0
2320e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\demokratiers\Whelpling\Slackerism\udstregningens.txttext
MD5:AB78DE3F9C61556A7A3186B25FC6E01C
SHA256:6A7B50A26B787930BE25D6EC78FD912E7151D7A2A08DD6FBF5A3075EEFA9B20F
2320e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\demokratiers\Whelpling\nonmasculine.initext
MD5:B99CC61154507CDA412BB9B08BA0B94D
SHA256:26BA158654DCD86405B747209D9EDC3671463944E3F3005377EA727DBD3E4B8D
2320e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\demokratiers\Whelpling\rappeling.onibinary
MD5:9287D7FD488FF67D20C175690444DB11
SHA256:53ECC6F17B1AF6983169F9755AFB4684E31B3BFEB7D58256DEAEC3A2FDAB5FF0
2320e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\demokratiers\Whelpling\Slackerism\sekundrlitteratur.initext
MD5:8B64252A198425D946A29492B095F1BD
SHA256:5B534BCF4A34129641640CFCFF8BF266A1CC7C0B7950377D8D40CC4C8BE821F8
2320e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exeC:\Users\admin\AppData\Local\Temp\nsnBE80.tmp\System.dllexecutable
MD5:0D7AD4F45DC6F5AA87F606D0331C6901
SHA256:3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
26
DNS requests
15
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.18.121.151:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
GET
200
2.18.121.151:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
2104
svchost.exe
GET
200
2.18.121.151:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
5244
e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe
GET
200
142.251.39.99:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
whitelisted
5244
e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe
GET
200
142.251.39.99:80
http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDx560%2FLqy01BCQNkH7kIyt
unknown
whitelisted
5244
e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe
GET
200
142.251.39.99:80
http://o.pki.goog/wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEAtphStRphWCCu97iO6vuXk%3D
unknown
whitelisted
5244
e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe
GET
200
142.251.39.99:80
http://c.pki.goog/r/r1.crl
unknown
whitelisted
7148
remcos.exe
GET
200
178.237.33.50:80
http://geoplugin.net/json.gp
unknown
whitelisted
6760
SIHClient.exe
GET
200
173.223.117.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
6760
SIHClient.exe
GET
200
173.223.117.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
whitelisted
5496
MoUsoCoreWorker.exe
2.18.121.151:80
crl.microsoft.com
AKAMAI-AS
FR
whitelisted
2.18.121.151:80
crl.microsoft.com
AKAMAI-AS
FR
whitelisted
2104
svchost.exe
2.18.121.151:80
crl.microsoft.com
AKAMAI-AS
FR
whitelisted
5496
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5512
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5244
e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe
142.251.39.110:443
drive.google.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.168.206
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 2.18.121.151
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
drive.google.com
  • 142.251.39.110
whitelisted
ocsp.pki.goog
  • 142.251.39.99
whitelisted
c.pki.goog
  • 142.251.39.99
whitelisted
o.pki.goog
  • 142.251.39.99
whitelisted
drive.usercontent.google.com
  • 142.250.179.161
whitelisted
geoplugin.net
  • 178.237.33.50
whitelisted

Threats

PID
Process
Class
Message
7148
remcos.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 38
7148
remcos.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
7148
remcos.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
7148
remcos.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
7148
remcos.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
No debug info