analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe

Full analysis: https://app.any.run/tasks/b526bf5f-8eb4-4f95-9268-a91ece426e6b
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Analysis date: October 05, 2022, 05:20:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
rat
remcos
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

85E8AE98556D7927FA40C5CBA4E4A16A

SHA1:

3013724DBC0BEDDA4BC2528BA01C7495F26614B1

SHA256:

F851CCD89EF8F8E28648FF600789364E9CAF5C522A5E7238CEE619A229CC821D

SSDEEP:

24576:WqHo1sfbYnNTHIsxcb5V9zpn8jte3q/3uASeA8vOE/dkJw1:WqIafENUkcb5rpn8Y3q/eAYU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • REMCOS detected by memory dumps

      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 2900)
    • REMCOS was detected

      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 2900)
  • SUSPICIOUS

    • Application launched itself

      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 3408)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Remcos

(PID) Process(2900) f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe
Max_keylog_file100000
Keylog_dirremcos
Copy_dirRemcos
Connect_delay0
Audio_dirMicRecords
Audio_path%ProgramFiles%
Audio_record_time5
Delete_fileFalse
Mouse_optionFalse
Screenshot_cryptFalse
Screenshot_fileScreenshots
Screenshot_path%APPDATA%
Take_ScreenshotFalse
Screenshot_time5
Screenshot_flagFalse
Hide_keylogFalse
Keylog_cryptFalse
Keylog_filelogs.dat
Keylog_path%LOCALAPPDATA%
Keylog_flag1
Mutex_nameRmc-48V73L
Hide_fileFalse
Startup_valueRemcos
Copy_fileremcos.exe
Setup_path%LOCALAPPDATA%
Install_HKLM\Explorer\Run1
Install_HKLM\RunTrue
Install_HKCU\RunTrue
Install_flagFalse
Connect_interval1
BotnetNEW REM STUB
Hosts (1)valvesco.duckdns.org:5050
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (62)
.exe | Win64 Executable (generic) (23.3)
.dll | Win32 Dynamic Link Library (generic) (5.5)
.exe | Win32 Executable (generic) (3.8)
.exe | Win16/32 Executable Delphi generic (1.7)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 2022-Sep-27 04:33:10
Comments: -
CompanyName: Microsoft Corporation
FileDescription: Subst Utility
FileVersion: 1.0.0.0
InternalName: vpHP.exe
LegalCopyright: Copyright © Microsoft Corporation. All rights reserved.
LegalTrademarks: -
OriginalFilename: vpHP.exe
ProductName: Subst Utility
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

DOS Header

e_magic: MZ
e_cblp: 144
e_cp: 3
e_crlc: -
e_cparhdr: 4
e_minalloc: -
e_maxalloc: 65535
e_ss: -
e_sp: 184
e_csum: -
e_ip: -
e_cs: -
e_ovno: -
e_oemid: -
e_oeminfo: -
e_lfanew: 128

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 3
TimeDateStamp: 2022-Sep-27 04:33:10
PointerToSymbolTable: -
NumberOfSymbols: -
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
8192
1377752
1377792
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
7.48373
.rsrc
1392640
1008
1024
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.1796
.reloc
1400832
12
512
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
0.10191

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.3298
916
UNKNOWN
UNKNOWN
RT_VERSION

Imports

mscoree.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe no specs schtasks.exe no specs #REMCOS f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe

Process information

PID
CMD
Path
Indicators
Parent process
3408"C:\Users\admin\Desktop\f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe" C:\Users\admin\Desktop\f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exeExplorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Subst Utility
Exit code:
0
Version:
1.0.0.0
2736"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iDKZenUzizmrGT" /XML "C:\Users\admin\AppData\Local\Temp\tmp3A36.tmp"C:\Windows\System32\schtasks.exef851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2900"C:\Users\admin\Desktop\f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe"C:\Users\admin\Desktop\f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe
f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Subst Utility
Version:
1.0.0.0
Remcos
(PID) Process(2900) f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe
Max_keylog_file100000
Keylog_dirremcos
Copy_dirRemcos
Connect_delay0
Audio_dirMicRecords
Audio_path%ProgramFiles%
Audio_record_time5
Delete_fileFalse
Mouse_optionFalse
Screenshot_cryptFalse
Screenshot_fileScreenshots
Screenshot_path%APPDATA%
Take_ScreenshotFalse
Screenshot_time5
Screenshot_flagFalse
Hide_keylogFalse
Keylog_cryptFalse
Keylog_filelogs.dat
Keylog_path%LOCALAPPDATA%
Keylog_flag1
Mutex_nameRmc-48V73L
Hide_fileFalse
Startup_valueRemcos
Copy_fileremcos.exe
Setup_path%LOCALAPPDATA%
Install_HKLM\Explorer\Run1
Install_HKLM\RunTrue
Install_HKCU\RunTrue
Install_flagFalse
Connect_interval1
BotnetNEW REM STUB
Hosts (1)valvesco.duckdns.org:5050
Total events
424
Read events
414
Write events
10
Delete events
0

Modification events

(PID) Process:(3408) f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3408) f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3408) f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3408) f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2900) f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exeKey:HKEY_CURRENT_USER\Software\Rmc-48V73L
Operation:writeName:exepath
Value:
3B88E0473FDE58ECA0677C20322F543E3A80F38FFEB07DBA7B00708D947D8E27051F2F3E66028D0E12E4327D74D4D00D4139903D3F6BE4C668AA0405B5FF83A3333065C5A3BD2B9492690D229086AE434D576A2DB6051D9B1F679A344334E73D15C6239F120FAA522B35D3A96C7221CEB60D13F72A1641E089CA5B0F20A06763255A0B6270D208856546127F65E0B3D1543D566FB88B0C395537EF2D0453596E1AE8FC7D25315C655D4D6AFA75504C0E6AC13D1CF784F26C
(PID) Process:(2900) f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exeKey:HKEY_CURRENT_USER\Software\Rmc-48V73L
Operation:writeName:licence
Value:
886D37693D9FF1C51C536B98702B488C
Executable files
1
Suspicious files
1
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
2900f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exeC:\ProgramData\remcos\logs.datbinary
MD5:81F7B25EBACC762577B9AEDA2CAB3B7F
SHA256:99982DA915DA49E4B2DD575CEC29987C37A51C4C19A6CB26226F41896E4D2FD6
3408f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exeC:\Users\admin\AppData\Roaming\iDKZenUzizmrGT.exeexecutable
MD5:85E8AE98556D7927FA40C5CBA4E4A16A
SHA256:F851CCD89EF8F8E28648FF600789364E9CAF5C522A5E7238CEE619A229CC821D
3408f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exeC:\Users\admin\AppData\Local\Temp\tmp3A36.tmpxml
MD5:0D0204B2D9A3C7D85C0D4071A995998F
SHA256:E5D936A45F1EDAE67EF7FBCA7C18B8E77856F95AD1D4391336FF3BC9EFDB70C2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
5
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2900
f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe
81.161.229.148:5050
valvesco.duckdns.org
Delis LLC
US
malicious

DNS requests

Domain
IP
Reputation
valvesco.duckdns.org
  • 81.161.229.148
malicious

Threats

PID
Process
Class
Message
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2900
f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe
A Network Trojan was detected
ET TROJAN Remcos 3.x Unencrypted Checkin
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2900
f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe
A Network Trojan was detected
ET TROJAN Remcos 3.x Unencrypted Checkin
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2900
f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe
A Network Trojan was detected
ET TROJAN Remcos 3.x Unencrypted Checkin
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2900
f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe
A Network Trojan was detected
ET TROJAN Remcos 3.x Unencrypted Checkin
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2900
f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe
A Network Trojan was detected
ET TROJAN Remcos 3.x Unencrypted Checkin
No debug info