analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe

Full analysis: https://app.any.run/tasks/3013cb2e-df60-4974-a160-20f7982da7f1
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Analysis date: October 05, 2022, 06:12:41
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
rat
remcos
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

85E8AE98556D7927FA40C5CBA4E4A16A

SHA1:

3013724DBC0BEDDA4BC2528BA01C7495F26614B1

SHA256:

F851CCD89EF8F8E28648FF600789364E9CAF5C522A5E7238CEE619A229CC821D

SSDEEP:

24576:WqHo1sfbYnNTHIsxcb5V9zpn8jte3q/3uASeA8vOE/dkJw1:WqIafENUkcb5rpn8Y3q/eAYU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • REMCOS detected by memory dumps

      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 2616)
    • REMCOS was detected

      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 2616)
  • SUSPICIOUS

    • Application launched itself

      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 3160)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Remcos

(PID) Process(2616) f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe
Max_keylog_file100000
Keylog_dirremcos
Copy_dirRemcos
Connect_delay0
Audio_dirMicRecords
Audio_path%ProgramFiles%
Audio_record_time5
Delete_fileFalse
Mouse_optionFalse
Screenshot_cryptFalse
Screenshot_fileScreenshots
Screenshot_path%APPDATA%
Take_ScreenshotFalse
Screenshot_time5
Screenshot_flagFalse
Hide_keylogFalse
Keylog_cryptFalse
Keylog_filelogs.dat
Keylog_path%LOCALAPPDATA%
Keylog_flag1
Mutex_nameRmc-48V73L
Hide_fileFalse
Startup_valueRemcos
Copy_fileremcos.exe
Setup_path%LOCALAPPDATA%
Install_HKLM\Explorer\Run1
Install_HKLM\RunTrue
Install_HKCU\RunTrue
Install_flagFalse
Connect_interval1
BotnetNEW REM STUB
Hosts (1)valvesco.duckdns.org:5050
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (62)
.exe | Win64 Executable (generic) (23.3)
.dll | Win32 Dynamic Link Library (generic) (5.5)
.exe | Win32 Executable (generic) (3.8)
.exe | Win16/32 Executable Delphi generic (1.7)
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe no specs schtasks.exe no specs #REMCOS f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe

Process information

PID
CMD
Path
Indicators
Parent process
3160"C:\Users\admin\Desktop\f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe" C:\Users\admin\Desktop\f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exeExplorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Subst Utility
Exit code:
0
Version:
1.0.0.0
2484"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iDKZenUzizmrGT" /XML "C:\Users\admin\AppData\Local\Temp\tmpF57F.tmp"C:\Windows\System32\schtasks.exef851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2616"C:\Users\admin\Desktop\f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe"C:\Users\admin\Desktop\f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe
f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Subst Utility
Version:
1.0.0.0
Remcos
(PID) Process(2616) f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe
Max_keylog_file100000
Keylog_dirremcos
Copy_dirRemcos
Connect_delay0
Audio_dirMicRecords
Audio_path%ProgramFiles%
Audio_record_time5
Delete_fileFalse
Mouse_optionFalse
Screenshot_cryptFalse
Screenshot_fileScreenshots
Screenshot_path%APPDATA%
Take_ScreenshotFalse
Screenshot_time5
Screenshot_flagFalse
Hide_keylogFalse
Keylog_cryptFalse
Keylog_filelogs.dat
Keylog_path%LOCALAPPDATA%
Keylog_flag1
Mutex_nameRmc-48V73L
Hide_fileFalse
Startup_valueRemcos
Copy_fileremcos.exe
Setup_path%LOCALAPPDATA%
Install_HKLM\Explorer\Run1
Install_HKLM\RunTrue
Install_HKCU\RunTrue
Install_flagFalse
Connect_interval1
BotnetNEW REM STUB
Hosts (1)valvesco.duckdns.org:5050
Total events
424
Read events
414
Write events
10
Delete events
0

Modification events

(PID) Process:(3160) f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3160) f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3160) f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3160) f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2616) f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exeKey:HKEY_CURRENT_USER\Software\Rmc-48V73L
Operation:writeName:exepath
Value:
3B88E0473FDE58ECA0677C20322F543E3A80F38FFEB07DBA7B00708D947D8E27051F2F3E66028D0E12E4327D74D4D00D4139903D3F6BE4C668AA0405B5FF83A3333065C5A3BD2B9492690D229086AE434D576A2DB6051D9B1F679A344334E73D15C6239F120FAA522B35D3A96C7221CEB60D13F72A1641E089CA5B0F20A06763255A0B6270D208856546127F65E0B3D1543D566FB88B0C395537EF2D0453596E1AE8FC7D25315C655D4D6AFA75504C0E6AC13D1CF784F26C
(PID) Process:(2616) f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exeKey:HKEY_CURRENT_USER\Software\Rmc-48V73L
Operation:writeName:licence
Value:
886D37693D9FF1C51C536B98702B488C
Executable files
1
Suspicious files
1
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
2616f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exeC:\ProgramData\remcos\logs.datbinary
MD5:0AE45CC39571D8C0DFD3E67A60EF55CB
SHA256:C4A2401361F99BB55139ABA15293B47F20134DA0DB87A60A9BCFBF5BE9F252CD
3160f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exeC:\Users\admin\AppData\Roaming\iDKZenUzizmrGT.exeexecutable
MD5:85E8AE98556D7927FA40C5CBA4E4A16A
SHA256:F851CCD89EF8F8E28648FF600789364E9CAF5C522A5E7238CEE619A229CC821D
3160f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exeC:\Users\admin\AppData\Local\Temp\tmpF57F.tmpxml
MD5:0D0204B2D9A3C7D85C0D4071A995998F
SHA256:E5D936A45F1EDAE67EF7FBCA7C18B8E77856F95AD1D4391336FF3BC9EFDB70C2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2616
f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe
81.161.229.148:5050
valvesco.duckdns.org
Delis LLC
US
malicious

DNS requests

Domain
IP
Reputation
valvesco.duckdns.org
  • 81.161.229.148
malicious

Threats

PID
Process
Class
Message
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2616
f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe
A Network Trojan was detected
ET TROJAN Remcos 3.x Unencrypted Checkin
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2616
f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe
A Network Trojan was detected
ET TROJAN Remcos 3.x Unencrypted Checkin
No debug info