analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe

Full analysis: https://app.any.run/tasks/f9bd0e30-895e-4679-b2cd-b0b8d31c2f95
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: October 05, 2022, 06:36:28
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
rat
remcos
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

85E8AE98556D7927FA40C5CBA4E4A16A

SHA1:

3013724DBC0BEDDA4BC2528BA01C7495F26614B1

SHA256:

F851CCD89EF8F8E28648FF600789364E9CAF5C522A5E7238CEE619A229CC821D

SSDEEP:

24576:WqHo1sfbYnNTHIsxcb5V9zpn8jte3q/3uASeA8vOE/dkJw1:WqIafENUkcb5rpn8Y3q/eAYU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 3148)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2444)

    • Remcos is detected

      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 1556)
      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 1556)

    • REMCOS was detected

      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 1556)

    • REMCOS detected by memory dumps

      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 1556)

  • SUSPICIOUS

    • Reads the machine GUID from the registry

      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 3148)

    • Reads the BIOS version

      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 3148)

    • Reads Internet Settings

      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 3148)

    • Application launched itself

      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 3148)

  • INFO

    • Checks supported languages

      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 3148)
      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 1556)

    • Process checks LSA protection

      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 3148)

    • Reads the computer name

      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 3148)
      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 1556)

    • Creates files in the user directory

      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 3148)

    • Reads Environment values

      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 1556)

    • Reads product name

      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 1556)

    • Creates files in the program directory

      • f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe (PID: 1556)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Remcos

(PID) Process(1556) f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe
Max_keylog_file100000
Keylog_dirremcos
Copy_dirRemcos
Connect_delay0
Audio_dirMicRecords
Audio_path%ProgramFiles%
Audio_record_time5
Delete_fileFalse
Mouse_optionFalse
Screenshot_cryptFalse
Screenshot_fileScreenshots
Screenshot_path%APPDATA%
Take_ScreenshotFalse
Screenshot_time5
Screenshot_flagFalse
Hide_keylogFalse
Keylog_cryptFalse
Keylog_filelogs.dat
Keylog_path%LOCALAPPDATA%
Keylog_flag1
Mutex_nameRmc-48V73L
Hide_fileFalse
Startup_valueRemcos
Copy_fileremcos.exe
Setup_path%LOCALAPPDATA%
Install_HKLM\Explorer\Run1
Install_HKLM\RunTrue
Install_HKCU\RunTrue
Install_flagFalse
Connect_interval1
BotnetNEW REM STUB
Hosts (1)valvesco.duckdns.org:5050
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (62)
.exe | Win64 Executable (generic) (23.3)
.dll | Win32 Dynamic Link Library (generic) (5.5)
.exe | Win32 Executable (generic) (3.8)
.exe | Win16/32 Executable Delphi generic (1.7)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 2022-Sep-27 04:33:10
Comments: -
CompanyName: Microsoft Corporation
FileDescription: Subst Utility
FileVersion: 1.0.0.0
InternalName: vpHP.exe
LegalCopyright: Copyright © Microsoft Corporation. All rights reserved.
LegalTrademarks: -
OriginalFilename: vpHP.exe
ProductName: Subst Utility
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

DOS Header

e_magic: MZ
e_cblp: 144
e_cp: 3
e_crlc: -
e_cparhdr: 4
e_minalloc: -
e_maxalloc: 65535
e_ss: -
e_sp: 184
e_csum: -
e_ip: -
e_cs: -
e_ovno: -
e_oemid: -
e_oeminfo: -
e_lfanew: 128

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 3
TimeDateStamp: 2022-Sep-27 04:33:10
PointerToSymbolTable: -
NumberOfSymbols: -
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
8192
1377752
1377792
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
7.48373
.rsrc
1392640
1008
1024
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.1796
.reloc
1400832
12
512
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
0.10191

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.3298
916
UNKNOWN
UNKNOWN
RT_VERSION

Imports

mscoree.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe no specs schtasks.exe no specs #REMCOS f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe

Process information

PID
CMD
Path
Indicators
Parent process
3148"C:\Users\admin\Desktop\f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe" C:\Users\admin\Desktop\f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Subst Utility
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2444"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iDKZenUzizmrGT" /XML "C:\Users\admin\AppData\Local\Temp\tmpF1C6.tmp"C:\Windows\System32\schtasks.exe—f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\kernel32.dll
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1556"C:\Users\admin\Desktop\f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe"C:\Users\admin\Desktop\f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe
f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Subst Utility
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\advapi32.dll
Remcos
(PID) Process(1556) f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe
Max_keylog_file100000
Keylog_dirremcos
Copy_dirRemcos
Connect_delay0
Audio_dirMicRecords
Audio_path%ProgramFiles%
Audio_record_time5
Delete_fileFalse
Mouse_optionFalse
Screenshot_cryptFalse
Screenshot_fileScreenshots
Screenshot_path%APPDATA%
Take_ScreenshotFalse
Screenshot_time5
Screenshot_flagFalse
Hide_keylogFalse
Keylog_cryptFalse
Keylog_filelogs.dat
Keylog_path%LOCALAPPDATA%
Keylog_flag1
Mutex_nameRmc-48V73L
Hide_fileFalse
Startup_valueRemcos
Copy_fileremcos.exe
Setup_path%LOCALAPPDATA%
Install_HKLM\Explorer\Run1
Install_HKLM\RunTrue
Install_HKCU\RunTrue
Install_flagFalse
Connect_interval1
BotnetNEW REM STUB
Hosts (1)valvesco.duckdns.org:5050
Total events
424
Read events
414
Write events
10
Delete events
0

Modification events

(PID) Process:(3148) f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3148) f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3148) f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3148) f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1556) f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exeKey:HKEY_CURRENT_USER\Software\Rmc-48V73L
Operation:writeName:exepath
Value:
3B88E0473FDE58ECA0677C20322F543E3A80F38FFEB07DBA7B00708D947D8E27051F2F3E66028D0E12E4327D74D4D00D4139903D3F6BE4C668AA0405B5FF83A3333065C5A3BD2B9492690D229086AE434D576A2DB6051D9B1F679A344334E73D15C6239F120FAA522B35D3A96C7221CEB60D13F72A1641E089CA5B0F20A06763255A0B6270D208856546127F65E0B3D1543D566FB88B0C395537EF2D0453596E1AE8FC7D25315C655D4D6AFA75504C0E6AC13D1CF784F26C
(PID) Process:(1556) f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exeKey:HKEY_CURRENT_USER\Software\Rmc-48V73L
Operation:writeName:licence
Value:
886D37693D9FF1C51C536B98702B488C
Executable files
1
Suspicious files
1
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
3148f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exeC:\Users\admin\AppData\Roaming\iDKZenUzizmrGT.exeexecutable
MD5:85E8AE98556D7927FA40C5CBA4E4A16A
SHA256:F851CCD89EF8F8E28648FF600789364E9CAF5C522A5E7238CEE619A229CC821D
1556f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exeC:\ProgramData\remcos\logs.datbinary
MD5:99AD3BD9C78A66BF815F9EB7BA02ABC3
SHA256:77A089C30367C9E6F4FD0F7EA5DDBC9F2A250FEA657EFFE4B6C9DC2F15285224
3148f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exeC:\Users\admin\AppData\Local\Temp\tmpF1C6.tmpxml
MD5:0D0204B2D9A3C7D85C0D4071A995998F
SHA256:E5D936A45F1EDAE67EF7FBCA7C18B8E77856F95AD1D4391336FF3BC9EFDB70C2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
5
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1556
f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe
81.161.229.148:5050
valvesco.duckdns.org
Delis LLC
US
malicious

DNS requests

Domain
IP
Reputation
valvesco.duckdns.org
  • 81.161.229.148
malicious

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
1556
f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe
A Network Trojan was detected
ET TROJAN Remcos 3.x Unencrypted Checkin
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
1556
f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe
A Network Trojan was detected
ET TROJAN Remcos 3.x Unencrypted Checkin
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
1556
f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe
A Network Trojan was detected
ET TROJAN Remcos 3.x Unencrypted Checkin
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
1556
f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe
A Network Trojan was detected
ET TROJAN Remcos 3.x Unencrypted Checkin
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d.exe