analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

2C9JAy9

Full analysis: https://app.any.run/tasks/b0469708-1044-47b8-910b-30847160ddcd
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: January 10, 2019, 18:16:22
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
remcos
Indicators:
MIME: text/html
File info: HTML document, ASCII text, with very long lines
MD5:

2A82160964629165F8A2189B87BFADF0

SHA1:

9B300499CDA4F7FE8DFF7659DE4C9EBA8DCF0628

SHA256:

F8ED89D5D57BC2D6DE6C3A83DE7C7BBC00106E04D491FE0A50FAF2A896557FEF

SSDEEP:

96:aSb9yXLtR4v/UmIdQtUB3dcEgg9m1Q5gxA2YOReSuYTGqLTuWzbbNL4QtoKn5:aSbcLtR4UDK2B3d5gg9mwKU+uYK3WztH

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • oxzujl.exe (PID: 2236)
      • oxzujl.exe (PID: 2656)

    • REMCOS RAT was detected

      • oxzujl.exe (PID: 2656)

  • SUSPICIOUS

    • Cleans NTFS data-stream (Zone Identifier)

      • oxzujl.exe (PID: 2236)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 3556)

    • Application launched itself

      • oxzujl.exe (PID: 2236)

    • Creates files in the user directory

      • oxzujl.exe (PID: 2656)

    • Connects to unusual port

      • oxzujl.exe (PID: 2656)

  • INFO

    • Reads internet explorer settings

      • iexplore.exe (PID: 2208)

    • Reads Internet Cache Settings

      • chrome.exe (PID: 3556)
      • iexplore.exe (PID: 2208)

    • Reads settings of System Certificates

      • chrome.exe (PID: 3556)

    • Application launched itself

      • chrome.exe (PID: 3556)
      • iexplore.exe (PID: 2960)

    • Changes internet zones settings

      • iexplore.exe (PID: 2960)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.htm/html | HyperText Markup Language with DOCTYPE (80.6)
.html | HyperText Markup Language (19.3)

EXIF

HTML

referrer: always
ContentType: text/html; charset=utf-8
Title: Warning! | There might be a problem with the requested link
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
14
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start iexplore.exe iexplore.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs oxzujl.exe no specs #REMCOS oxzujl.exe

Process information

PID
CMD
Path
Indicators
Parent process
2960"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\Desktop\2C9JAy9.htmC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2208"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2960 CREDAT:79873C:\Program Files\Internet Explorer\iexplore.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3556"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
3221225547
Version:
68.0.3440.106
3268"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=68.0.3440.106 --initial-client-data=0x78,0x7c,0x80,0x74,0x84,0x6f4f00b0,0x6f4f00c0,0x6f4f00ccC:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
3668"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=3568 --on-initialized-event-handle=304 --parent-handle=308 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
2920"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=980,11888443782932172974,12728857008823790944,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAACAAwBAAQAAAAAAAAAAAGAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --service-request-channel-token=57E9BE88CD071886AB8F783894AD4F17 --mojo-platform-channel-handle=932 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
3872"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=980,11888443782932172974,12728857008823790944,131072 --enable-features=PasswordImport --service-pipe-token=CA89488523988371A2063178B572793C --lang=en-US --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=CA89488523988371A2063178B572793C --renderer-client-id=5 --mojo-platform-channel-handle=1912 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
2748"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=980,11888443782932172974,12728857008823790944,131072 --enable-features=PasswordImport --service-pipe-token=5A8CD81467635EB3BC77239807E02AE6 --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=5A8CD81467635EB3BC77239807E02AE6 --renderer-client-id=3 --mojo-platform-channel-handle=2044 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
3232"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=980,11888443782932172974,12728857008823790944,131072 --enable-features=PasswordImport --disable-gpu-compositing --service-pipe-token=C411F1310CD4691B4818080E022547C6 --lang=en-US --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=C411F1310CD4691B4818080E022547C6 --renderer-client-id=6 --mojo-platform-channel-handle=3548 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
3040"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=980,11888443782932172974,12728857008823790944,131072 --enable-features=PasswordImport --disable-gpu-compositing --service-pipe-token=0C49E50B45131B0E5D17175CD46DC78F --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=0C49E50B45131B0E5D17175CD46DC78F --renderer-client-id=7 --mojo-platform-channel-handle=3784 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
Total events
1 085
Read events
905
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
68
Text files
74
Unknown types
13

Dropped files

PID
Process
Filename
Type
2960iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico —
MD5:—
SHA256:—
2960iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
2960iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFDE8359A01D615C2B.TMP —
MD5:—
SHA256:—
2960iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFBC46878410A46947.TMP —
MD5:—
SHA256:—
2960iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFBB79FF70D252DD9A.TMP —
MD5:—
SHA256:—
2960iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFED547084541D37FE.TMP —
MD5:—
SHA256:—
2960iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{E549887F-1503-11E9-BAD8-5254004A04AF}.dat —
MD5:—
SHA256:—
3556chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old —
MD5:—
SHA256:—
3556chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG.old —
MD5:—
SHA256:—
3556chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\f06ad996-8dd9-4ead-9ae9-802e1dbe5206.tmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
25
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2960
iexplore.exe
GET
200
13.107.21.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3556
chrome.exe
172.217.23.131:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
3556
chrome.exe
172.217.16.131:443
www.gstatic.com
Google Inc.
US
whitelisted
3556
chrome.exe
216.58.207.42:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted
2960
iexplore.exe
13.107.21.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3556
chrome.exe
172.217.22.13:443
accounts.google.com
Google Inc.
US
whitelisted
3556
chrome.exe
172.217.22.3:443
www.google.de
Google Inc.
US
whitelisted
3556
chrome.exe
216.58.207.67:443
ssl.gstatic.com
Google Inc.
US
whitelisted
3556
chrome.exe
172.217.16.195:443
www.google.nl
Google Inc.
US
whitelisted
3556
chrome.exe
172.217.23.164:443
www.google.com
Google Inc.
US
whitelisted
3556
chrome.exe
104.27.172.56:443
a.uchi.moe
Cloudflare Inc
US
shared

DNS requests

Domain
IP
Reputation
www.bing.com
  • 13.107.21.200
  • 204.79.197.200
whitelisted
www.google.de
  • 172.217.22.3
whitelisted
clientservices.googleapis.com
  • 172.217.23.131
whitelisted
www.gstatic.com
  • 172.217.16.131
whitelisted
safebrowsing.googleapis.com
  • 216.58.207.42
whitelisted
accounts.google.com
  • 172.217.22.13
shared
ssl.gstatic.com
  • 216.58.207.67
whitelisted
apis.google.com
  • 172.217.16.206
whitelisted
www.google.com
  • 172.217.23.164
whitelisted
www.google.nl
  • 172.217.16.195
whitelisted

Threats

Found threats are available for the paid subscriptions
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
2C9JAy9