File name:

e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe

Full analysis: https://app.any.run/tasks/693ff265-0510-4fcb-9993-f2075482c3c1
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Analysis date: March 25, 2025, 03:35:20
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
rat
remcos
remote
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

F84CA85C72B7E1DBA1896FCB85E2ECF1

SHA1:

0A253FE4FFF7E3C7A52AB24AE5BF5B9A823C376F

SHA256:

E6B6CB1272025F0A6857CE9CFA7CC6CB5A170F9E9C7C4BE351CD56A5C6D777BE

SSDEEP:

49152:feai7BarKQeZWByvoWBTFiF3Ovx/MBciGsdIzzsy9NKzEwLQbeZwjlHeIsvp:carKQCoWBTYF32/fiG2I8y9kzJLQF83p

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Executing a file with an untrusted certificate

      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 5244)
      • remcos.exe (PID: 5800)
      • remcos.exe (PID: 7148)
    • REMCOS has been detected

      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 5244)
      • remcos.exe (PID: 7148)
    • REMCOS mutex has been found

      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 5244)
      • remcos.exe (PID: 7148)
    • Changes the autorun value in the registry

      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 5244)
      • remcos.exe (PID: 7148)
    • Actions looks like stealing of personal data

      • recover.exe (PID: 2040)
      • recover.exe (PID: 2552)
      • recover.exe (PID: 1040)
    • REMCOS has been detected (SURICATA)

      • remcos.exe (PID: 7148)
    • Steals credentials from Web Browsers

      • recover.exe (PID: 1040)
  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 2320)
      • remcos.exe (PID: 5800)
    • Malware-specific behavior (creating "System.dll" in Temp)

      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 2320)
      • remcos.exe (PID: 5800)
    • Executable content was dropped or overwritten

      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 2320)
      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 5244)
      • remcos.exe (PID: 5800)
    • Application launched itself

      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 2320)
      • remcos.exe (PID: 5800)
    • There is functionality for taking screenshot (YARA)

      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 2320)
      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 5244)
      • remcos.exe (PID: 5800)
      • remcos.exe (PID: 7148)
    • Reads security settings of Internet Explorer

      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 5244)
      • remcos.exe (PID: 7148)
    • Starts itself from another location

      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 5244)
    • Connects to unusual port

      • remcos.exe (PID: 7148)
    • Contacting a server suspected of hosting an CnC

      • remcos.exe (PID: 7148)
  • INFO

    • Checks supported languages

      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 2320)
      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 5244)
      • remcos.exe (PID: 5800)
      • remcos.exe (PID: 7148)
    • The sample compiled with english language support

      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 2320)
      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 5244)
    • Reads the computer name

      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 2320)
      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 5244)
      • remcos.exe (PID: 5800)
      • remcos.exe (PID: 7148)
    • Creates files or folders in the user directory

      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 2320)
      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 5244)
      • remcos.exe (PID: 7148)
    • Create files in a temporary directory

      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 2320)
      • remcos.exe (PID: 5800)
      • recover.exe (PID: 1040)
      • recover.exe (PID: 2040)
      • recover.exe (PID: 2552)
    • Reads the software policy settings

      • slui.exe (PID: 5512)
      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 5244)
      • slui.exe (PID: 5968)
      • remcos.exe (PID: 7148)
    • Checks proxy server information

      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 5244)
      • slui.exe (PID: 5968)
      • remcos.exe (PID: 7148)
    • Reads the machine GUID from the registry

      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 5244)
      • remcos.exe (PID: 7148)
    • Creates files in the program directory

      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 5244)
    • Process checks computer location settings

      • e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe (PID: 5244)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:12:15 22:24:07+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 25600
InitializedDataSize: 3805696
UninitializedDataSize: 2048
EntryPoint: 0x336c
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.2.0.0
ProductVersionNumber: 2.2.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Mail-Well Inc.
FileDescription: Energizer Holdings Inc.
FileVersion: 2.2.0.0
InternalName: staalorm.exe
ProductName: Xamasoft
ProductVersion: 2.2.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
142
Monitored processes
10
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe sppextcomobj.exe no specs slui.exe #REMCOS e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe slui.exe remcos.exe #REMCOS remcos.exe recover.exe recover.exe recover.exe

Process information

PID
CMD
Path
Indicators
Parent process
1040C:\Windows\SysWOW64\recover.exe /stext "C:\Users\admin\AppData\Local\Temp\tpnmectugpl"C:\Windows\SysWOW64\recover.exe
remcos.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Recover Files Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\recover.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2040C:\Windows\SysWOW64\recover.exe /stext "C:\Users\admin\AppData\Local\Temp\glgygfoqifvkqvqahj"C:\Windows\SysWOW64\recover.exe
remcos.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Recover Files Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\recover.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2320"C:\Users\admin\Desktop\e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe" C:\Users\admin\Desktop\e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe
explorer.exe
User:
admin
Company:
Mail-Well Inc.
Integrity Level:
MEDIUM
Description:
Energizer Holdings Inc.
Exit code:
0
Version:
2.2.0.0
Modules
Images
c:\users\admin\desktop\e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2552C:\Windows\SysWOW64\recover.exe /stext "C:\Users\admin\AppData\Local\Temp\wraffmewuxdfnp"C:\Windows\SysWOW64\recover.exe
remcos.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Recover Files Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\recover.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5244"C:\Users\admin\Desktop\e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe" C:\Users\admin\Desktop\e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe
e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe
User:
admin
Company:
Mail-Well Inc.
Integrity Level:
MEDIUM
Description:
Energizer Holdings Inc.
Exit code:
0
Version:
2.2.0.0
Modules
Images
c:\windows\syswow64\mshtml.dll
c:\users\admin\desktop\e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5512"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5800"C:\ProgramData\Remcos\remcos.exe" C:\ProgramData\Remcos\remcos.exe
e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe
User:
admin
Company:
Mail-Well Inc.
Integrity Level:
MEDIUM
Description:
Energizer Holdings Inc.
Exit code:
0
Version:
2.2.0.0
Modules
Images
c:\programdata\remcos\remcos.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5968C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6372C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exesvchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7148"C:\ProgramData\Remcos\remcos.exe" C:\ProgramData\Remcos\remcos.exe
remcos.exe
User:
admin
Company:
Mail-Well Inc.
Integrity Level:
MEDIUM
Description:
Energizer Holdings Inc.
Version:
2.2.0.0
Modules
Images
c:\windows\syswow64\mshtml.dll
c:\programdata\remcos\remcos.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
3 352
Read events
3 331
Write events
21
Delete events
0

Modification events

(PID) Process:(2320) e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\CLR\Start
Operation:writeName:CLR Start
Value:
2
(PID) Process:(2320) e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exeKey:HKEY_CURRENT_USER\SOFTWARE\Service
Operation:writeName:System_Check
Value:
kernel32::CreateFileA(m r4 , i 0x80000000, i 0, p 0, i 4, i 0x80, i 0)i.r5
(PID) Process:(2320) e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exeKey:HKEY_CURRENT_USER\SOFTWARE\Service
Operation:writeName:System_Check
Value:
kernel32::SetFilePointer(i r5, i 13101 , i 0,i 0)
(PID) Process:(2320) e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exeKey:HKEY_CURRENT_USER\SOFTWARE\Service
Operation:writeName:System_Check
Value:
kernel32::VirtualAlloc(i 0,i 64532480, i 0x3000, i 0x40)p.r2
(PID) Process:(2320) e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exeKey:HKEY_CURRENT_USER\SOFTWARE\Service
Operation:writeName:System_Check
Value:
kernel32::ReadFile(i r5, i r2, i 64532480,*i 0, i 0)
(PID) Process:(2320) e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exeKey:HKEY_CURRENT_USER\SOFTWARE\Service
Operation:writeName:System_Check
Value:
user32::EnumWindows(i r2 ,i 0)
(PID) Process:(5800) remcos.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\CLR\Start
Operation:writeName:CLR Start
Value:
2
(PID) Process:(5800) remcos.exeKey:HKEY_CURRENT_USER\SOFTWARE\Service
Operation:writeName:System_Check
Value:
kernel32::CreateFileA(m r4 , i 0x80000000, i 0, p 0, i 4, i 0x80, i 0)i.r5
(PID) Process:(5800) remcos.exeKey:HKEY_CURRENT_USER\SOFTWARE\Service
Operation:writeName:System_Check
Value:
kernel32::SetFilePointer(i r5, i 13101 , i 0,i 0)
(PID) Process:(5800) remcos.exeKey:HKEY_CURRENT_USER\SOFTWARE\Service
Operation:writeName:System_Check
Value:
kernel32::VirtualAlloc(i 0,i 64532480, i 0x3000, i 0x40)p.r2
Executable files
3
Suspicious files
15
Text files
14
Unknown types
0

Dropped files

PID
Process
Filename
Type
2320e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\demokratiers\Whelpling\electrotonus.she
MD5:
SHA256:
2320e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\demokratiers\Whelpling\fatherkin.def
MD5:
SHA256:
2320e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\demokratiers\Whelpling\branddrjt.Pla82binary
MD5:39CD816346D600A454C60BB2E088612D
SHA256:4E92F70445B10B7BC817E85E5679F352751353F369A27C9C68D4DB2749F78E44
2320e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\demokratiers\Whelpling\Arbejdskampes.jpgimage
MD5:6084ED1962644967BFB0F96646B9B0DD
SHA256:F92C6D1043CB0617E99CBF304F86DC6DEB3DE5F27C62EB58E49744F35E2126C0
2320e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\demokratiers\Whelpling\ilbud.jpgimage
MD5:8A2A79979F03A03064432DD5BC966AA6
SHA256:94CE196E219BF4535361B4150E391BB1679A251D7BBB52B74512A0743CB92E8E
2320e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\demokratiers\Whelpling\Unailing.txttext
MD5:173FED1B6F6372E4B2ECBBEE9D3924FF
SHA256:C591E1A67AA41ECA2FEF8665CAD5426ABCE95672E7A669EB439CF2D3E09C8CD7
2320e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\demokratiers\Whelpling\Shagbark.initext
MD5:EB1C0382A53130BF25A307A4B87FFD76
SHA256:2282841FC047F2ECE7A34403FB622C969D8886E16D6C1ACB665E260DD7DC7779
2320e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\demokratiers\Whelpling\rappeling.onibinary
MD5:9287D7FD488FF67D20C175690444DB11
SHA256:53ECC6F17B1AF6983169F9755AFB4684E31B3BFEB7D58256DEAEC3A2FDAB5FF0
2320e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\demokratiers\Whelpling\bittermlks.txttext
MD5:EDB65849470EE0E6FD12C45C0013262E
SHA256:89C71B92AF074CF759379AB5346EA3650B8B5D925D8FBEFE1698A4AC7786420C
2320e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\demokratiers\Whelpling\Willness31.inibinary
MD5:59150CCAC09AA9D38AEDFE442FEB24B7
SHA256:4218E98D3A3CB94E95437500E9DEF6B00F295FF623113F88A12B905868835492
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
26
DNS requests
15
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.18.121.151:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
2104
svchost.exe
GET
200
2.18.121.151:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
GET
200
2.18.121.151:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
5244
e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe
GET
200
142.251.39.99:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
whitelisted
5244
e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe
GET
200
142.251.39.99:80
http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDx560%2FLqy01BCQNkH7kIyt
unknown
whitelisted
5244
e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe
GET
200
142.251.39.99:80
http://c.pki.goog/r/r1.crl
unknown
whitelisted
5244
e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe
GET
200
142.251.39.99:80
http://o.pki.goog/wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEAtphStRphWCCu97iO6vuXk%3D
unknown
whitelisted
6760
SIHClient.exe
GET
200
173.223.117.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
6760
SIHClient.exe
GET
200
173.223.117.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
7148
remcos.exe
GET
200
178.237.33.50:80
http://geoplugin.net/json.gp
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
whitelisted
5496
MoUsoCoreWorker.exe
2.18.121.151:80
crl.microsoft.com
AKAMAI-AS
FR
whitelisted
2.18.121.151:80
crl.microsoft.com
AKAMAI-AS
FR
whitelisted
2104
svchost.exe
2.18.121.151:80
crl.microsoft.com
AKAMAI-AS
FR
whitelisted
5496
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5512
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5244
e6b6cb1272025f0a6857ce9cfa7cc6cb5a170f9e9c7c4be351cd56a5c6d777be.exe
142.251.39.110:443
drive.google.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.168.206
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 2.18.121.151
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
drive.google.com
  • 142.251.39.110
whitelisted
ocsp.pki.goog
  • 142.251.39.99
whitelisted
c.pki.goog
  • 142.251.39.99
whitelisted
o.pki.goog
  • 142.251.39.99
whitelisted
drive.usercontent.google.com
  • 142.250.179.161
whitelisted
geoplugin.net
  • 178.237.33.50
whitelisted

Threats

PID
Process
Class
Message
7148
remcos.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 38
7148
remcos.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
7148
remcos.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
7148
remcos.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
7148
remcos.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
No debug info