File name:

17428195249b70b5fe2696771a3fe5139f1faff68e91a4d919998c46ebd29b5464e0a2cf6f640.dat-decoded.exe

Full analysis: https://app.any.run/tasks/ebcea289-7085-4745-b313-d6ccbc51db2f
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Analysis date: March 24, 2025, 12:43:43
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
rat
remcos
remote
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

2F13698F26E20AD4E7A5F0C34D9E5468

SHA1:

271970F4590FC3C5D21E42CDE5CEF984D72AC3E9

SHA256:

ED45A049347B7565CE1D6C2D28CCB92A58ABD70177B37A777EB887470FFB6815

SSDEEP:

12288:qucEko68OD9XdZ3JiY0meNN2od7bQc1kcnB6ZYEpWVVVVVVVVVVVVVVVVV667:Ko6869wMENXbFt6ZJpF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • REMCOS has been detected

      • 17428195249b70b5fe2696771a3fe5139f1faff68e91a4d919998c46ebd29b5464e0a2cf6f640.dat-decoded.exe (PID: 4688)
    • REMCOS mutex has been found

      • 17428195249b70b5fe2696771a3fe5139f1faff68e91a4d919998c46ebd29b5464e0a2cf6f640.dat-decoded.exe (PID: 4688)
    • REMCOS has been detected (YARA)

      • 17428195249b70b5fe2696771a3fe5139f1faff68e91a4d919998c46ebd29b5464e0a2cf6f640.dat-decoded.exe (PID: 4688)
    • REMCOS has been detected (SURICATA)

      • 17428195249b70b5fe2696771a3fe5139f1faff68e91a4d919998c46ebd29b5464e0a2cf6f640.dat-decoded.exe (PID: 4688)
  • SUSPICIOUS

    • There is functionality for taking screenshot (YARA)

      • 17428195249b70b5fe2696771a3fe5139f1faff68e91a4d919998c46ebd29b5464e0a2cf6f640.dat-decoded.exe (PID: 4688)
    • Connects to unusual port

      • 17428195249b70b5fe2696771a3fe5139f1faff68e91a4d919998c46ebd29b5464e0a2cf6f640.dat-decoded.exe (PID: 4688)
    • Contacting a server suspected of hosting an CnC

      • 17428195249b70b5fe2696771a3fe5139f1faff68e91a4d919998c46ebd29b5464e0a2cf6f640.dat-decoded.exe (PID: 4688)
  • INFO

    • Reads the computer name

      • 17428195249b70b5fe2696771a3fe5139f1faff68e91a4d919998c46ebd29b5464e0a2cf6f640.dat-decoded.exe (PID: 4688)
    • Checks supported languages

      • 17428195249b70b5fe2696771a3fe5139f1faff68e91a4d919998c46ebd29b5464e0a2cf6f640.dat-decoded.exe (PID: 4688)
    • Reads the machine GUID from the registry

      • 17428195249b70b5fe2696771a3fe5139f1faff68e91a4d919998c46ebd29b5464e0a2cf6f640.dat-decoded.exe (PID: 4688)
    • Checks proxy server information

      • slui.exe (PID: 7152)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:02:24 10:00:11+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.16
CodeSize: 356864
InitializedDataSize: 140800
UninitializedDataSize: -
EntryPoint: 0x34d64
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
130
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #REMCOS 17428195249b70b5fe2696771a3fe5139f1faff68e91a4d919998c46ebd29b5464e0a2cf6f640.dat-decoded.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
4688"C:\Users\admin\Desktop\17428195249b70b5fe2696771a3fe5139f1faff68e91a4d919998c46ebd29b5464e0a2cf6f640.dat-decoded.exe" C:\Users\admin\Desktop\17428195249b70b5fe2696771a3fe5139f1faff68e91a4d919998c46ebd29b5464e0a2cf6f640.dat-decoded.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\17428195249b70b5fe2696771a3fe5139f1faff68e91a4d919998c46ebd29b5464e0a2cf6f640.dat-decoded.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7152C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
4 827
Read events
4 823
Write events
4
Delete events
0

Modification events

(PID) Process:(4688) 17428195249b70b5fe2696771a3fe5139f1faff68e91a4d919998c46ebd29b5464e0a2cf6f640.dat-decoded.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-JAGJAW
Operation:writeName:exepath
Value:
8943381ECFC14260CD3A4F43F2FAA7DF9C62B7855A546CED9D2EACF78A270B773F0A8D68EE92DFAA6C9154D37DE4163E556029158D2A7A5FCD2DADB85F86BF72B5E095C1E94492AD0001268E901FD73F8913F79376FD9A9367A875E63281A125F9CE5E8645043620C581AD9990F5ADC4BC063C0D3061D8FBD2C92D5CDB871F523565C86DAAFAFFFCA0807ADF7877A29162F0112665D20E4AAD2C6C360B51FE59E2D7032ACAB7D73B151F8FA1925CE64D2134B34346CF16BAC81649908D8C49888378E2CE1F69CD910C1600513D4C7EBCA1079261AC0BA4BE8C462380E6C410ED1743A492C08ECD601521
(PID) Process:(4688) 17428195249b70b5fe2696771a3fe5139f1faff68e91a4d919998c46ebd29b5464e0a2cf6f640.dat-decoded.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-JAGJAW
Operation:writeName:licence
Value:
6153073B431E78BEB58F1F6FEE5B80FD
(PID) Process:(4688) 17428195249b70b5fe2696771a3fe5139f1faff68e91a4d919998c46ebd29b5464e0a2cf6f640.dat-decoded.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-JAGJAW
Operation:writeName:time
Value:
(PID) Process:(4688) 17428195249b70b5fe2696771a3fe5139f1faff68e91a4d919998c46ebd29b5464e0a2cf6f640.dat-decoded.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-JAGJAW
Operation:writeName:UID
Value:
984138791
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
36
TCP/UDP connections
137
DNS requests
18
Threats
175

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
2.16.164.72:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
GET
304
52.149.20.212:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
1188
SIHClient.exe
GET
200
23.48.23.183:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
whitelisted
1188
SIHClient.exe
GET
200
23.48.23.183:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
whitelisted
1188
SIHClient.exe
GET
200
2.19.217.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
whitelisted
1188
SIHClient.exe
GET
200
2.19.217.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
1188
SIHClient.exe
GET
200
2.19.217.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
whitelisted
1188
SIHClient.exe
GET
200
2.19.217.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
whitelisted
1188
SIHClient.exe
GET
200
2.19.217.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
unknown
whitelisted
GET
200
20.242.39.171:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
whitelisted
3216
svchost.exe
20.198.162.78:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
SG
whitelisted
2104
svchost.exe
2.16.164.72:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4688
17428195249b70b5fe2696771a3fe5139f1faff68e91a4d919998c46ebd29b5464e0a2cf6f640.dat-decoded.exe
192.227.168.165:14645
dukasbecomeagreatpersonwhowantotbecomegreatnessfor.ydns.eu
AS-COLOCROSSING
US
malicious
6544
svchost.exe
20.190.160.132:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
864
backgroundTaskHost.exe
20.74.47.205:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
  • 51.124.78.146
whitelisted
google.com
  • 142.250.185.78
whitelisted
client.wns.windows.com
  • 20.198.162.78
whitelisted
crl.microsoft.com
  • 2.16.164.72
  • 2.16.164.34
  • 2.16.164.51
  • 23.48.23.183
  • 23.48.23.158
  • 23.48.23.190
  • 23.48.23.194
  • 23.48.23.137
  • 23.48.23.140
  • 23.48.23.162
  • 23.48.23.169
  • 23.48.23.177
whitelisted
dukasbecomeagreatpersonwhowantotbecomegreatnessfor.ydns.eu
  • 192.227.168.165
unknown
login.live.com
  • 20.190.160.132
  • 20.190.160.14
  • 20.190.160.2
  • 20.190.160.4
  • 40.126.32.76
  • 40.126.32.136
  • 20.190.160.65
  • 40.126.32.68
whitelisted
arc.msn.com
  • 20.74.47.205
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
www.microsoft.com
  • 2.19.217.218
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Misc activity
INFO [ANY.RUN] Dynamic DNS Service (ydns .eu)
4688
17428195249b70b5fe2696771a3fe5139f1faff68e91a4d919998c46ebd29b5464e0a2cf6f640.dat-decoded.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
4688
17428195249b70b5fe2696771a3fe5139f1faff68e91a4d919998c46ebd29b5464e0a2cf6f640.dat-decoded.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
4688
17428195249b70b5fe2696771a3fe5139f1faff68e91a4d919998c46ebd29b5464e0a2cf6f640.dat-decoded.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
4688
17428195249b70b5fe2696771a3fe5139f1faff68e91a4d919998c46ebd29b5464e0a2cf6f640.dat-decoded.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
4688
17428195249b70b5fe2696771a3fe5139f1faff68e91a4d919998c46ebd29b5464e0a2cf6f640.dat-decoded.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
4688
17428195249b70b5fe2696771a3fe5139f1faff68e91a4d919998c46ebd29b5464e0a2cf6f640.dat-decoded.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
4688
17428195249b70b5fe2696771a3fe5139f1faff68e91a4d919998c46ebd29b5464e0a2cf6f640.dat-decoded.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
4688
17428195249b70b5fe2696771a3fe5139f1faff68e91a4d919998c46ebd29b5464e0a2cf6f640.dat-decoded.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
4688
17428195249b70b5fe2696771a3fe5139f1faff68e91a4d919998c46ebd29b5464e0a2cf6f640.dat-decoded.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
No debug info