File name:

Sigmanly_fd1f814527b20c677b1d8b366be6b75c08219b5c315f0d0d9f8535a13aba2c47

Full analysis: https://app.any.run/tasks/2fb7561e-f138-40d3-86d3-8330ac5e309b
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Analysis date: May 15, 2025, 13:48:21
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
rat
remcos
remote
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

141617DFA7749238386F41B1952D9006

SHA1:

8783823587DBFEFC39C7158CFE414E3CDD780037

SHA256:

FD1F814527B20C677B1D8B366BE6B75C08219B5C315F0D0D9F8535A13ABA2C47

SSDEEP:

49152:KdW4YfumSnKJuGoZ2d8qh9FFpEgJgvJ2Wm/6K7xlb71FMZO1yrgI1oZr8Ygm/zl5:4VBIpEEedOP7Txs1m/zlP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • REMCOS has been detected (YARA)

      • Sigmanly_fd1f814527b20c677b1d8b366be6b75c08219b5c315f0d0d9f8535a13aba2c47.exe (PID: 4756)
    • REMCOS has been detected (SURICATA)

      • Sigmanly_fd1f814527b20c677b1d8b366be6b75c08219b5c315f0d0d9f8535a13aba2c47.exe (PID: 4756)
  • SUSPICIOUS

    • Application launched itself

      • Sigmanly_fd1f814527b20c677b1d8b366be6b75c08219b5c315f0d0d9f8535a13aba2c47.exe (PID: 1452)
    • There is functionality for taking screenshot (YARA)

      • Sigmanly_fd1f814527b20c677b1d8b366be6b75c08219b5c315f0d0d9f8535a13aba2c47.exe (PID: 4756)
    • Connects to unusual port

      • Sigmanly_fd1f814527b20c677b1d8b366be6b75c08219b5c315f0d0d9f8535a13aba2c47.exe (PID: 4756)
    • Contacting a server suspected of hosting an CnC

      • Sigmanly_fd1f814527b20c677b1d8b366be6b75c08219b5c315f0d0d9f8535a13aba2c47.exe (PID: 4756)
  • INFO

    • Reads the machine GUID from the registry

      • Sigmanly_fd1f814527b20c677b1d8b366be6b75c08219b5c315f0d0d9f8535a13aba2c47.exe (PID: 1452)
      • Sigmanly_fd1f814527b20c677b1d8b366be6b75c08219b5c315f0d0d9f8535a13aba2c47.exe (PID: 4756)
    • Reads the computer name

      • Sigmanly_fd1f814527b20c677b1d8b366be6b75c08219b5c315f0d0d9f8535a13aba2c47.exe (PID: 1452)
      • Sigmanly_fd1f814527b20c677b1d8b366be6b75c08219b5c315f0d0d9f8535a13aba2c47.exe (PID: 4756)
    • Checks supported languages

      • Sigmanly_fd1f814527b20c677b1d8b366be6b75c08219b5c315f0d0d9f8535a13aba2c47.exe (PID: 1452)
      • Sigmanly_fd1f814527b20c677b1d8b366be6b75c08219b5c315f0d0d9f8535a13aba2c47.exe (PID: 4756)
    • Checks proxy server information

      • slui.exe (PID: 920)
    • Reads the software policy settings

      • slui.exe (PID: 920)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Remcos

(PID) Process(4756) Sigmanly_fd1f814527b20c677b1d8b366be6b75c08219b5c315f0d0d9f8535a13aba2c47.exe
C2 (1)204.10.160.146:49263
BotnetServer
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueRemcos
Hide_fileFalse
Mutex_name9734-ZB01PH
Keylog_flag0
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
Max_keylog_file100000
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (55.8)
.exe | Win64 Executable (generic) (21)
.scr | Windows screen saver (9.9)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2071:11:28 04:02:54+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 1046528
InitializedDataSize: 5120
UninitializedDataSize: -
EntryPoint: 0x10172e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 3.7.145.8
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: 高级网络客户端,具有安全连接、数据同步和分布式计算功能
CompanyName: 星云地平线科技
FileDescription: 皇网枢纽
FileVersion: 3.7.145.8
InternalName: ZNbB.exe
LegalCopyright: © 星云地平线科技 • 保留所有权利 • 2025
LegalTrademarks: 皇网™ • 星地量子系列
OriginalFileName: ZNbB.exe
ProductName: 皇网枢纽
ProductVersion: Quantum.2025.Spring
AssemblyVersion: 3.7.145.8
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
123
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start sigmanly_fd1f814527b20c677b1d8b366be6b75c08219b5c315f0d0d9f8535a13aba2c47.exe no specs sigmanly_fd1f814527b20c677b1d8b366be6b75c08219b5c315f0d0d9f8535a13aba2c47.exe no specs #REMCOS sigmanly_fd1f814527b20c677b1d8b366be6b75c08219b5c315f0d0d9f8535a13aba2c47.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
920C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1452"C:\Users\admin\Desktop\Sigmanly_fd1f814527b20c677b1d8b366be6b75c08219b5c315f0d0d9f8535a13aba2c47.exe" C:\Users\admin\Desktop\Sigmanly_fd1f814527b20c677b1d8b366be6b75c08219b5c315f0d0d9f8535a13aba2c47.exeexplorer.exe
User:
admin
Company:
星云地平线科技
Integrity Level:
MEDIUM
Description:
皇网枢纽
Exit code:
0
Version:
3.7.145.8
Modules
Images
c:\users\admin\desktop\sigmanly_fd1f814527b20c677b1d8b366be6b75c08219b5c315f0d0d9f8535a13aba2c47.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
4756"C:\Users\admin\Desktop\Sigmanly_fd1f814527b20c677b1d8b366be6b75c08219b5c315f0d0d9f8535a13aba2c47.exe"C:\Users\admin\Desktop\Sigmanly_fd1f814527b20c677b1d8b366be6b75c08219b5c315f0d0d9f8535a13aba2c47.exe
Sigmanly_fd1f814527b20c677b1d8b366be6b75c08219b5c315f0d0d9f8535a13aba2c47.exe
User:
admin
Company:
星云地平线科技
Integrity Level:
MEDIUM
Description:
皇网枢纽
Version:
3.7.145.8
Modules
Images
c:\users\admin\desktop\sigmanly_fd1f814527b20c677b1d8b366be6b75c08219b5c315f0d0d9f8535a13aba2c47.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Remcos
(PID) Process(4756) Sigmanly_fd1f814527b20c677b1d8b366be6b75c08219b5c315f0d0d9f8535a13aba2c47.exe
C2 (1)204.10.160.146:49263
BotnetServer
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueRemcos
Hide_fileFalse
Mutex_name9734-ZB01PH
Keylog_flag0
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
Max_keylog_file100000
6640"C:\Users\admin\Desktop\Sigmanly_fd1f814527b20c677b1d8b366be6b75c08219b5c315f0d0d9f8535a13aba2c47.exe"C:\Users\admin\Desktop\Sigmanly_fd1f814527b20c677b1d8b366be6b75c08219b5c315f0d0d9f8535a13aba2c47.exeSigmanly_fd1f814527b20c677b1d8b366be6b75c08219b5c315f0d0d9f8535a13aba2c47.exe
User:
admin
Company:
星云地平线科技
Integrity Level:
MEDIUM
Description:
皇网枢纽
Exit code:
4294967295
Version:
3.7.145.8
Modules
Images
c:\users\admin\desktop\sigmanly_fd1f814527b20c677b1d8b366be6b75c08219b5c315f0d0d9f8535a13aba2c47.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
Total events
4 748
Read events
4 746
Write events
2
Delete events
0

Modification events

(PID) Process:(4756) Sigmanly_fd1f814527b20c677b1d8b366be6b75c08219b5c315f0d0d9f8535a13aba2c47.exeKey:HKEY_CURRENT_USER\SOFTWARE\9734-ZB01PH
Operation:writeName:exepath
Value:
4B8959519FCA16D00D67C8A5281C06C8F939F1DD76B524C9C6BABBC1CF7F55A889D9987C3AF5A0E9458F167DAF23669C802730DED316F46478FB71BAAD61DAC3CDD64A77B2F02BE4BED792B0FD969C17E1119FF5692AA1F9A47CA3F293201819F976DF3B32BD805C88DC863F244B6B795D248882CB3AE9DC904584F7ABEFBF26DF818BC219F4A7A2D7CBC7589BB913E382ABBA77A4E3DC2E9F5856966C5BC31C1836F64C409FAE636B66EA63A05648373CEA435C32C13FAF3A85E7B50F08EF2CC3090F41C49C1522BDA8
(PID) Process:(4756) Sigmanly_fd1f814527b20c677b1d8b366be6b75c08219b5c315f0d0d9f8535a13aba2c47.exeKey:HKEY_CURRENT_USER\SOFTWARE\9734-ZB01PH
Operation:writeName:licence
Value:
2CCF5C50E58A6B37F4C5F9BA5879F6C2
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
102
DNS requests
4
Threats
164

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
whitelisted
4756
Sigmanly_fd1f814527b20c677b1d8b366be6b75c08219b5c315f0d0d9f8535a13aba2c47.exe
204.10.160.146:49263
UNREAL-SERVERS
CA
malicious
6808
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
920
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
google.com
  • 142.250.186.46
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
4756
Sigmanly_fd1f814527b20c677b1d8b366be6b75c08219b5c315f0d0d9f8535a13aba2c47.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
4756
Sigmanly_fd1f814527b20c677b1d8b366be6b75c08219b5c315f0d0d9f8535a13aba2c47.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
4756
Sigmanly_fd1f814527b20c677b1d8b366be6b75c08219b5c315f0d0d9f8535a13aba2c47.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
4756
Sigmanly_fd1f814527b20c677b1d8b366be6b75c08219b5c315f0d0d9f8535a13aba2c47.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
4756
Sigmanly_fd1f814527b20c677b1d8b366be6b75c08219b5c315f0d0d9f8535a13aba2c47.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
4756
Sigmanly_fd1f814527b20c677b1d8b366be6b75c08219b5c315f0d0d9f8535a13aba2c47.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
4756
Sigmanly_fd1f814527b20c677b1d8b366be6b75c08219b5c315f0d0d9f8535a13aba2c47.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
4756
Sigmanly_fd1f814527b20c677b1d8b366be6b75c08219b5c315f0d0d9f8535a13aba2c47.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
4756
Sigmanly_fd1f814527b20c677b1d8b366be6b75c08219b5c315f0d0d9f8535a13aba2c47.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
4756
Sigmanly_fd1f814527b20c677b1d8b366be6b75c08219b5c315f0d0d9f8535a13aba2c47.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
No debug info