File name: | Confirmation transfer MT103 Ref_002735672.exe |
Full analysis: | https://app.any.run/tasks/db0489e7-57b9-410c-b91d-4c089c2f05ab |
Verdict: | Malicious activity |
Threats: | Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links. |
Analysis date: | March 31, 2023, 23:18:38 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 64 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows |
MD5: | 5156850B1A68F4643B8FD4D59B6B0B75 |
SHA1: | 8B4844157D313775E1D08EF00254665A6DC2C39B |
SHA256: | F3E4DD541766CD7A3AF91EF964B91DED632F13EBE69BD4FB5EADD563C0207059 |
SSDEEP: | 24576:dAVZ9OiCs4UpxfaZuBkHdK6Cgd68Q/ZiyDB2+MW9p64Hiz:+3Ys4UpMuGHdI8QL4/W9p3H |
.exe | | | Generic CIL Executable (.NET, Mono, etc.) (56.7) |
---|---|---|
.exe | | | Win64 Executable (generic) (21.3) |
.scr | | | Windows screen saver (10.1) |
.dll | | | Win32 Dynamic Link Library (generic) (5) |
.exe | | | Win32 Executable (generic) (3.4) |
MachineType: | Intel 386 or later, and compatibles |
---|---|
TimeStamp: | 2023:03:28 03:36:33+00:00 |
ImageFileCharacteristics: | Executable, 32-bit |
PEType: | PE32 |
LinkerVersion: | 48 |
CodeSize: | 1122816 |
InitializedDataSize: | 9216 |
UninitializedDataSize: | - |
EntryPoint: | 0x11408a |
OSVersion: | 4 |
ImageVersion: | - |
SubsystemVersion: | 4 |
Subsystem: | Windows GUI |
FileVersionNumber: | 1.0.0.0 |
ProductVersionNumber: | 1.0.0.0 |
FileFlagsMask: | 0x003f |
FileFlags: | (none) |
FileOS: | Win32 |
ObjectFileType: | Executable application |
FileSubtype: | - |
LanguageCode: | Neutral |
CharacterSet: | Unicode |
Comments: | - |
CompanyName: | Sambo's |
FileDescription: | neurosim |
FileVersion: | 1.0.0.0 |
InternalName: | jbBJ.exe |
LegalCopyright: | Copyright © Sambo's |
LegalTrademarks: | neurosim |
OriginalFileName: | jbBJ.exe |
ProductName: | neurosim |
ProductVersion: | 1.0.0.0 |
AssemblyVersion: | 1.0.0.0 |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 28-Mar-2023 03:36:33 |
Debug artifacts: |
|
Comments: | - |
CompanyName: | Sambo's |
FileDescription: | neurosim |
FileVersion: | 1.0.0.0 |
InternalName: | jbBJ.exe |
LegalCopyright: | Copyright © Sambo's |
LegalTrademarks: | neurosim |
OriginalFilename: | jbBJ.exe |
ProductName: | neurosim |
ProductVersion: | 1.0.0.0 |
Assembly Version: | 1.0.0.0 |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000080 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 3 |
Time date stamp: | 28-Mar-2023 03:36:33 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00002000 | 0x00112098 | 0x00112200 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 7.94151 |
.rsrc | 0x00116000 | 0x00002010 | 0x00002200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 7.47822 |
.reloc | 0x0011A000 | 0x0000000C | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 0.10191 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 3.26038 | 812 | Latin 1 / Western European | UNKNOWN | RT_VERSION |
32512 | 1.51664 | 20 | Latin 1 / Western European | UNKNOWN | RT_GROUP_ICON |
mscoree.dll |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
680 | "C:\Users\admin\AppData\Local\Temp\Confirmation transfer MT103 Ref_002735672.exe" | C:\Users\admin\AppData\Local\Temp\Confirmation transfer MT103 Ref_002735672.exe | explorer.exe | ||||||||||||
User: admin Company: Sambo's Integrity Level: MEDIUM Description: neurosim Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
1368 | "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SfXstPVdvOAUd" /XML "C:\Users\admin\AppData\Local\Temp\tmp789C.tmp" | C:\Windows\SysWOW64\schtasks.exe | — | Confirmation transfer MT103 Ref_002735672.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
1432 | "C:\Users\admin\AppData\Local\Temp\Confirmation transfer MT103 Ref_002735672.exe" | C:\Users\admin\AppData\Local\Temp\Confirmation transfer MT103 Ref_002735672.exe | Confirmation transfer MT103 Ref_002735672.exe | ||||||||||||
User: admin Company: Sambo's Integrity Level: MEDIUM Description: neurosim Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
1756 | "C:\ProgramData\Remcos\remcos.exe" | C:\ProgramData\Remcos\remcos.exe | — | Confirmation transfer MT103 Ref_002735672.exe | |||||||||||
User: admin Company: Sambo's Integrity Level: MEDIUM Description: neurosim Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
1272 | "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SfXstPVdvOAUd" /XML "C:\Users\admin\AppData\Local\Temp\tmp3F67.tmp" | C:\Windows\SysWOW64\schtasks.exe | — | remcos.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Manages scheduled tasks Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
824 | "C:\ProgramData\Remcos\remcos.exe" | C:\ProgramData\Remcos\remcos.exe | remcos.exe | ||||||||||||
User: admin Company: Sambo's Integrity Level: MEDIUM Description: neurosim Version: 1.0.0.0 Modules
Remcos(PID) Process(824) remcos.exe Hosts (1)fresh03.ddns.net:34110 BotnetUpgraded001 Connect_interval1 Install_flagTrue Install_HKCU\RunTrue Install_HKLM\RunTrue Install_HKLM\Explorer\Run1 Setup_path%LOCALAPPDATA% Copy_fileremcos.exe Startup_valueRemcos Hide_fileFalse Mutex_nameRmc-O0ARTY Keylog_flag0 Keylog_path%LOCALAPPDATA% Keylog_filelogs.dat Keylog_cryptFalse Hide_keylogFalse Screenshot_flagFalse Screenshot_time5 Take_ScreenshotFalse Screenshot_path%APPDATA% Screenshot_fileScreenshots Screenshot_cryptFalse Mouse_optionFalse Delete_fileFalse Audio_record_time5 Audio_path%ProgramFiles% Audio_dirMicRecords Connect_delay0 Copy_dirRemcos Keylog_dirremcos Max_keylog_file100000 |
(PID) Process: | (680) Confirmation transfer MT103 Ref_002735672.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (680) Confirmation transfer MT103 Ref_002735672.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (680) Confirmation transfer MT103 Ref_002735672.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
(PID) Process: | (680) Confirmation transfer MT103 Ref_002735672.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 0 | |||
(PID) Process: | (1432) Confirmation transfer MT103 Ref_002735672.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (1432) Confirmation transfer MT103 Ref_002735672.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (1432) Confirmation transfer MT103 Ref_002735672.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
(PID) Process: | (1432) Confirmation transfer MT103 Ref_002735672.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 0 | |||
(PID) Process: | (1756) remcos.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (1756) remcos.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 |
PID | Process | Filename | Type | |
---|---|---|---|---|
1432 | Confirmation transfer MT103 Ref_002735672.exe | C:\ProgramData\Remcos\remcos.exe | executable | |
MD5:5156850B1A68F4643B8FD4D59B6B0B75 | SHA256:F3E4DD541766CD7A3AF91EF964B91DED632F13EBE69BD4FB5EADD563C0207059 | |||
1756 | remcos.exe | C:\Users\admin\AppData\Local\Temp\tmp3F67.tmp | xml | |
MD5:AAC3585D92EC12A2AF059CF55E94E8AB | SHA256:8699098A78DB11F40F27CD5EB679CADE450D5CCA0D814B6B8D4BF35D3251EC9C | |||
680 | Confirmation transfer MT103 Ref_002735672.exe | C:\Users\admin\AppData\Roaming\SfXstPVdvOAUd.exe | executable | |
MD5:5156850B1A68F4643B8FD4D59B6B0B75 | SHA256:F3E4DD541766CD7A3AF91EF964B91DED632F13EBE69BD4FB5EADD563C0207059 | |||
824 | remcos.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDW1XBVN\json[1].json | binary | |
MD5:F90E88B638763D4C5AA8DBEA17373307 | SHA256:512C023C63B8F2E78FEBAFF3BA0DD95108D9623DEB9DEB396BA129EFE56B8FCC | |||
680 | Confirmation transfer MT103 Ref_002735672.exe | C:\Users\admin\AppData\Local\Temp\tmp789C.tmp | xml | |
MD5:AAC3585D92EC12A2AF059CF55E94E8AB | SHA256:8699098A78DB11F40F27CD5EB679CADE450D5CCA0D814B6B8D4BF35D3251EC9C |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
824 | remcos.exe | GET | 200 | 178.237.33.50:80 | http://geoplugin.net/json.gp | NL | binary | 945 b | suspicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
824 | remcos.exe | 178.237.33.50:80 | geoplugin.net | Schuberg Philis B.V. | NL | suspicious |
— | — | 103.169.34.187:34110 | fresh03.ddns.net | ODS ONLINE DATA SOLUTION JOINT STOCK COMPANY | VN | unknown |
Domain | IP | Reputation |
---|---|---|
fresh03.ddns.net |
| malicious |
geoplugin.net |
| suspicious |
PID | Process | Class | Message |
---|---|---|---|
— | — | Potentially Bad Traffic | ET POLICY DNS Query to DynDNS Domain *.ddns .net |
824 | remcos.exe | Unknown Classtype | ET JA3 Hash - Remcos 3.x TLS Connection |