File name:	14122024_0125_RTM09878GH.cmd.zip
Full analysis:	https://app.any.run/tasks/e95adde7-2df2-4079-9656-885567bbbe3f
Verdict:	Malicious activity
Threats:	Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links. Remcos is a commercially distributed remote administration and surveillance tool that has been widely observed in unauthorized deployments, where threat actors use it to perform remote actions on compromised machines. It is actively maintained by its vendor, with new versions and feature updates released on a frequent, near-monthly basis. Remcos ist eine Malware vom Typ RAT, mit der Angreifer aus der Ferne Aktionen auf infizierten Computern durchführen können. Diese Malware ist extrem aktiv und wird fast jeden Monat mit Updates auf den neuesten Stand gebracht. Malware Trends Tracker >>>
Analysis date:	December 14, 2024, 01:31:13
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	arch-exec rat remcos
Indicators:
MIME:	application/zip
File info:	Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:	B46AF5547637E668E50D9A27F3355233
SHA1:	BFC10872B0467DDA536D4D891593025383D00B12
SHA256:	E75A4696986EFC34B686C88ACBB183396FA22B765623D026C3D272BE87C57650
SSDEEP:	24576:VoQCQl1JaEGmAE4JfeXXXEXwztbI9V2nuL1tR2VzEyNWl5diLb44Yj/JaEiQdsdL:VoQnl1JtGmT4JfeHXEWtM9V2nuL1tsV1

ZipRequiredVersion:	20
ZipBitFlag:	-
ZipCompression:	Deflated
ZipModifyDate:	2024:12:12 21:25:30
ZipCRC:	0x0ae43f56
ZipCompressedSize:	846020
ZipUncompressedSize:	849920
ZipFileName:	RTM09878GH.cmd


(PID) Process:	(6296) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	3
Value: C:\Users\admin\Desktop\preferences.zip
(PID) Process:	(6296) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	2
Value: C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:	(6296) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	1
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:	(6296) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	0
Value: C:\Users\admin\Desktop\14122024_0125_RTM09878GH.cmd.zip
(PID) Process:	(6296) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	name
Value: 120
(PID) Process:	(6296) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	size
Value: 80
(PID) Process:	(6296) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	type
Value: 120
(PID) Process:	(6296) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	mtime
Value: 100
(PID) Process:	(6460) RTM09878GH.cmd	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance
Operation:	write	Name:	Enabled
Value: 0
(PID) Process:	(6836) ngen.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Rmc-MKYDDH
Operation:	write	Name:	time
Value:

PID	Process	Filename		Type
6956	WerFault.exe	C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RTM09878GH.cmd_932eaf5ca5ad0f1ce4d74afefe91dbb43b12354_4d7606e3_a9e2c8d3-9ef4-47aa-bdc2-d4975a990bba\Report.wer		—
		MD5:—	SHA256:—
6956	WerFault.exe	C:\Users\admin\AppData\Local\CrashDumps\RTM09878GH.cmd.6460.dmp		—
		MD5:—	SHA256:—
6956	WerFault.exe	C:\ProgramData\Microsoft\Windows\WER\Temp\WER7E6B.tmp.WERInternalMetadata.xml		xml
		MD5:0C7331D44EA394820B860CE612213249	SHA256:D482E630BCBA3A1E8DFDE4887EE9B8534B53E7AF4C3D60669F68EC5E3F36812E
6704	powershell.exe	C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_3jd24hdi.m4x.psm1		text
		MD5:D17FE0A3F47BE24A6453E9EF58C94641	SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6704	powershell.exe	C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_e2s2hezd.zlw.ps1		text
		MD5:D17FE0A3F47BE24A6453E9EF58C94641	SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6956	WerFault.exe	C:\ProgramData\Microsoft\Windows\WER\Temp\WER7EAB.tmp.xml		xml
		MD5:F8BCEB96A8DB9429457D9965F1BCFDBC	SHA256:E9459AA1DCC6027F476C6BE70F05EC42DBA7DFFB5396F5DD4D46169023DD65AD
6956	WerFault.exe	C:\ProgramData\Microsoft\Windows\WER\Temp\WER7B3E.tmp.dmp		binary
		MD5:48596418AC58504A179A5DCEA32896A0	SHA256:0EAF4DEFD1DA4E23F3B929AF7166121695E20D19DE440166E549A324BABEDAB2
5752	MpCmdRun.exe	C:\Users\admin\AppData\Local\Temp\MpCmdRun.log		text
		MD5:79B52FFBB7F10E72D4E600AC1BF3554B	SHA256:E3A4817C66AA0864B989CFA807BD32D04B8B1D2625CA2074CC2D2EA7A1C57A89
6296	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\Rar$VR6296.23081\Rar$Scan38655.bat		text
		MD5:B63F7C24E35EFA1FB91A691F288E9CE3	SHA256:6518B2AC3C1555AD2D68BD9A2BA45F118770787F6B230928C4C7EB72767669E3
6836	ngen.exe	C:\ProgramData\remcos\logs.dat		binary
		MD5:E12C354E23A9EFA020E63E5660310E29	SHA256:51915E27023AA9072F75ABBFB0BD95B2A59DD0A9C3CE3CF26763CD871AFC17AE

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
4712	MoUsoCoreWorker.exe	GET	200	2.16.164.106:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
3508	svchost.exe	GET	200	2.16.164.106:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
4428	RUXIMICS.exe	GET	200	2.16.164.106:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
4712	MoUsoCoreWorker.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
4428	RUXIMICS.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
3508	svchost.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
3508	svchost.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
—	—	192.168.100.255:138	—	—	—	whitelisted
4712	MoUsoCoreWorker.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4428	RUXIMICS.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
4712	MoUsoCoreWorker.exe	2.16.164.106:80	crl.microsoft.com	Akamai International B.V.	NL	whitelisted
4428	RUXIMICS.exe	2.16.164.106:80	crl.microsoft.com	Akamai International B.V.	NL	whitelisted
3508	svchost.exe	2.16.164.106:80	crl.microsoft.com	Akamai International B.V.	NL	whitelisted
4712	MoUsoCoreWorker.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted
4428	RUXIMICS.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	20.73.194.208 40.127.240.158	whitelisted
google.com	172.217.16.206	whitelisted
crl.microsoft.com	2.16.164.106 2.16.164.49	whitelisted
www.microsoft.com	95.101.149.131	whitelisted
watson.events.data.microsoft.com	52.168.117.173	whitelisted
self.events.data.microsoft.com	20.189.173.18	whitelisted

PID	Process	Class	Message
6836	ngen.exe	Malware Command and Control Activity Detected	ET MALWARE Remcos 3.x Unencrypted Checkin
6836	ngen.exe	Malware Command and Control Activity Detected	ET MALWARE Remcos 3.x Unencrypted Checkin
6836	ngen.exe	Malware Command and Control Activity Detected	ET MALWARE Remcos 3.x Unencrypted Checkin
6836	ngen.exe	Malware Command and Control Activity Detected	ET MALWARE Remcos 3.x Unencrypted Checkin
6836	ngen.exe	Malware Command and Control Activity Detected	ET MALWARE Remcos 3.x Unencrypted Checkin
6836	ngen.exe	Malware Command and Control Activity Detected	ET MALWARE Remcos 3.x Unencrypted Checkin
6836	ngen.exe	Malware Command and Control Activity Detected	ET MALWARE Remcos 3.x Unencrypted Checkin
6836	ngen.exe	Malware Command and Control Activity Detected	ET MALWARE Remcos 3.x Unencrypted Checkin
6836	ngen.exe	Malware Command and Control Activity Detected	ET MALWARE Remcos 3.x Unencrypted Checkin
6836	ngen.exe	Malware Command and Control Activity Detected	ET MALWARE Remcos 3.x Unencrypted Checkin

General Info

14122024_0125_RTM09878GH.cmd.zip

B46AF5547637E668E50D9A27F3355233

BFC10872B0467DDA536D4D891593025383D00B12

E75A4696986EFC34B686C88ACBB183396FA22B765623D026C3D272BE87C57650

24576:VoQCQl1JaEGmAE4JfeXXXEXwztbI9V2nuL1tR2VzEyNWl5diLb44Yj/JaEiQdsdL:VoQnl1JtGmT4JfeHXEWtM9V2nuL1tsV1

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Generic archive extractor

Adds path to the Windows Defender exclusion list

REMCOS mutex has been found

REMCOS has been detected

REMCOS has been detected (YARA)

REMCOS has been detected (SURICATA)

Antivirus name has been found in the command line (generic signature)

Connects to the CnC server

SUSPICIOUS

Reads the BIOS version

Read disk information to detect sandboxing environments

The process checks if it is being run in the virtual environment

Reads security settings of Internet Explorer

Reads the date of Windows installation

Starts POWERSHELL.EXE for commands execution

Script adds exclusion path to Windows Defender

Start notepad (likely ransomware note)

Executes application which crashes

There is functionality for taking screenshot (YARA)

Contacting a server suspected of hosting an CnC

Starts CMD.EXE for commands execution

Suspicious files were dropped or overwritten

Executing commands from a ".bat" file

Connects to unusual port

INFO

Reads the machine GUID from the registry

Manual execution by a user

Reads the computer name

Checks supported languages

Process checks computer location settings

The process uses the downloaded file

Reads the software policy settings

Checks proxy server information

Creates files in the program directory

Checks if a key exists in the options dictionary (POWERSHELL)

Script raised an exception (POWERSHELL)

Create files in a temporary directory

Executable content was dropped or overwritten

Creates files or folders in the user directory

Malware configuration

Static information

TRiD

EXIF

ZIP

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Information

Modules