analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe

Full analysis: https://app.any.run/tasks/3f353715-740f-4fa7-89e2-4187df77daa9
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Analysis date: October 05, 2022, 07:19:24
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
rat
remcos
keylogger
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

85E8AE98556D7927FA40C5CBA4E4A16A

SHA1:

3013724DBC0BEDDA4BC2528BA01C7495F26614B1

SHA256:

F851CCD89EF8F8E28648FF600789364E9CAF5C522A5E7238CEE619A229CC821D

SSDEEP:

24576:WqHo1sfbYnNTHIsxcb5V9zpn8jte3q/3uASeA8vOE/dkJw1:WqIafENUkcb5rpn8Y3q/eAYU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 3328)
    • Uses Task Scheduler to run other applications

      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 892)
    • Drops the executable file immediately after the start

      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 892)
    • Remcos is detected

      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 2764)
      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 2764)
    • REMCOS detected by memory dumps

      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 2764)
    • REMCOS was detected

      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 2764)
    • Connects to the CnC server

      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 2764)
  • SUSPICIOUS

    • Reads the machine GUID from the registry

      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 892)
    • Reads Internet Settings

      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 892)
    • Reads the BIOS version

      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 892)
    • Application launched itself

      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 892)
    • Executable content was dropped or overwritten

      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 892)
    • Writes files like Keylogger logs

      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 2764)
  • INFO

    • Process checks LSA protection

      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 892)
    • Checks supported languages

      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 892)
      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 2764)
    • Reads the computer name

      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 892)
      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 2764)
    • Creates files in the user directory

      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 892)
    • Reads Environment values

      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 2764)
    • Reads product name

      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 2764)
    • Creates files in the program directory

      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 2764)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Remcos

(PID) Process(2764) f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe
Max_keylog_file100000
Keylog_dirremcos
Copy_dirRemcos
Connect_delay0
Audio_dirMicRecords
Audio_path%ProgramFiles%
Audio_record_time5
Delete_fileFalse
Mouse_optionFalse
Screenshot_cryptFalse
Screenshot_fileScreenshots
Screenshot_path%APPDATA%
Take_ScreenshotFalse
Screenshot_time5
Screenshot_flagFalse
Hide_keylogFalse
Keylog_cryptFalse
Keylog_filelogs.dat
Keylog_path%LOCALAPPDATA%
Keylog_flag1
Mutex_nameRmc-48V73L
Hide_fileFalse
Startup_valueRemcos
Copy_fileremcos.exe
Setup_path%LOCALAPPDATA%
Install_HKLM\Explorer\Run1
Install_HKLM\RunTrue
Install_HKCU\RunTrue
Install_flagFalse
Connect_interval1
BotnetNEW REM STUB
Hosts (1)valvesco.duckdns.org:5050
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (62)
.exe | Win64 Executable (generic) (23.3)
.dll | Win32 Dynamic Link Library (generic) (5.5)
.exe | Win32 Executable (generic) (3.8)
.exe | Win16/32 Executable Delphi generic (1.7)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 2022-Sep-27 04:33:10
Comments: -
CompanyName: Microsoft Corporation
FileDescription: Subst Utility
FileVersion: 1.0.0.0
InternalName: vpHP.exe
LegalCopyright: Copyright © Microsoft Corporation. All rights reserved.
LegalTrademarks: -
OriginalFilename: vpHP.exe
ProductName: Subst Utility
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

DOS Header

e_magic: MZ
e_cblp: 144
e_cp: 3
e_crlc: -
e_cparhdr: 4
e_minalloc: -
e_maxalloc: 65535
e_ss: -
e_sp: 184
e_csum: -
e_ip: -
e_cs: -
e_ovno: -
e_oemid: -
e_oeminfo: -
e_lfanew: 128

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 3
TimeDateStamp: 2022-Sep-27 04:33:10
PointerToSymbolTable: -
NumberOfSymbols: -
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
8192
1377752
1377792
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
7.48373
.rsrc
1392640
1008
1024
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.1796
.reloc
1400832
12
512
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
0.10191

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.3298
916
UNKNOWN
UNKNOWN
RT_VERSION

Imports

mscoree.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start drop and start start f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe schtasks.exe no specs f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe no specs #REMCOS f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe

Process information

PID
CMD
Path
Indicators
Parent process
892"C:\Users\admin\Desktop\f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe" C:\Users\admin\Desktop\f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Subst Utility
Exit code:
0
Version:
1.0.0.0
3328"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iDKZenUzizmrGT" /XML "C:\Users\admin\AppData\Local\Temp\tmp3F56.tmp"C:\Windows\System32\schtasks.exef851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2768"C:\Users\admin\Desktop\f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe"C:\Users\admin\Desktop\f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exef851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Subst Utility
Exit code:
4294967295
Version:
1.0.0.0
2764"C:\Users\admin\Desktop\f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe"C:\Users\admin\Desktop\f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe
f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Subst Utility
Version:
1.0.0.0
Remcos
(PID) Process(2764) f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe
Max_keylog_file100000
Keylog_dirremcos
Copy_dirRemcos
Connect_delay0
Audio_dirMicRecords
Audio_path%ProgramFiles%
Audio_record_time5
Delete_fileFalse
Mouse_optionFalse
Screenshot_cryptFalse
Screenshot_fileScreenshots
Screenshot_path%APPDATA%
Take_ScreenshotFalse
Screenshot_time5
Screenshot_flagFalse
Hide_keylogFalse
Keylog_cryptFalse
Keylog_filelogs.dat
Keylog_path%LOCALAPPDATA%
Keylog_flag1
Mutex_nameRmc-48V73L
Hide_fileFalse
Startup_valueRemcos
Copy_fileremcos.exe
Setup_path%LOCALAPPDATA%
Install_HKLM\Explorer\Run1
Install_HKLM\RunTrue
Install_HKCU\RunTrue
Install_flagFalse
Connect_interval1
BotnetNEW REM STUB
Hosts (1)valvesco.duckdns.org:5050
Total events
424
Read events
414
Write events
10
Delete events
0

Modification events

(PID) Process:(892) f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(892) f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(892) f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(892) f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2764) f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exeKey:HKEY_CURRENT_USER\Software\Rmc-48V73L
Operation:writeName:exepath
Value:
3B88E0473FDE58ECA0677C20322F543E3A80F38FFEB07DBA7B00708D947D8E27051F2F3E66028D0E12E4327D74D4D00D4139903D3F6BE4C668AA0405B5FF83A3333065C5A3BD2B9492690D229086AE434D576A2DB6051D9B1F679A344334E73D15C6239F120FAA522B35D3A96C7221CEB60D13F72A1641E089CA5B0F20A06763255A0B6270D208856546127F65E0B3D1543D566FB88B0C395537EF2D0453596E1AE8FC7D25315C655D4D6AFA75504C0E6AC13D1CF784F26C
(PID) Process:(2764) f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exeKey:HKEY_CURRENT_USER\Software\Rmc-48V73L
Operation:writeName:licence
Value:
886D37693D9FF1C51C536B98702B488C
Executable files
1
Suspicious files
1
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
2764f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exeC:\ProgramData\remcos\logs.datbinary
MD5:E9DFED6248D2DDA7FA17924F31236552
SHA256:C07B932C398BD8C7C897A9AA22B6221DC5FC024C466B11FE4025A0366C3A0787
892f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exeC:\Users\admin\AppData\Roaming\iDKZenUzizmrGT.exeexecutable
MD5:85E8AE98556D7927FA40C5CBA4E4A16A
SHA256:F851CCD89EF8F8E28648FF600789364E9CAF5C522A5E7238CEE619A229CC821D
892f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exeC:\Users\admin\AppData\Local\Temp\tmp3F56.tmpxml
MD5:0D0204B2D9A3C7D85C0D4071A995998F
SHA256:E5D936A45F1EDAE67EF7FBCA7C18B8E77856F95AD1D4391336FF3BC9EFDB70C2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
3
DNS requests
3
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2764
f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe
81.161.229.148:5050
valvesco.duckdns.org
Delis LLC
US
malicious

DNS requests

Domain
IP
Reputation
valvesco.duckdns.org
  • 81.161.229.148
malicious

Threats

PID
Process
Class
Message
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2764
f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe
A Network Trojan was detected
ET TROJAN Remcos 3.x Unencrypted Checkin
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2764
f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe
A Network Trojan was detected
ET TROJAN Remcos 3.x Unencrypted Checkin
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2764
f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe
A Network Trojan was detected
ET TROJAN Remcos 3.x Unencrypted Checkin
No debug info