popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

rem.exe

Browser Login Data Stealer Generic Malware Malicious Library Downloader UPX Malicious Packer PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 May 16, 2024, 9:01 a.m. May 16, 2024, 9:05 a.m.
Size 483.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 06f5b8dffc6c138828adbc7f29cfc7f0
SHA256 03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7
CRC32 C76C2C43
ssdeep 6144:aXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZDAXYcNx5Gv:aX7tPMK8ctGe4Dzl4h2QnuPs/ZDIcv
Yara
  • Malicious_Library_Zero - Malicious_Library
  • Network_Downloader - File Downloader
  • infoStealer_browser_b_Zero - browser info stealer
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
leetboy.dynuddns.net
A 185.196.11.252
185.196.11.252
IP Address Status Action
164.124.101.2 Active Moloch
185.196.11.252 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 185.196.11.252:1998 -> 192.168.56.101:49179 2400031 ET DROP Spamhaus DROP Listed Traffic Inbound group 32 Misc Attack
TCP 192.168.56.101:49166 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49162 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49183 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49188 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49174 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49189 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49178 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49177 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49202 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49184 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49195 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49191 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
UDP 192.168.56.101:59002 -> 164.124.101.2:53 2045995 ET INFO DYNAMIC_DNS Query to a *.dynuddns .net Domain Potentially Bad Traffic
TCP 192.168.56.101:49203 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49179 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49164 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49192 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49180 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49194 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49209 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49200 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49185 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49232 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49165 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49207 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49186 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49181 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49198 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49210 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49190 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49204 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49196 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49213 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49193 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49201 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49214 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49219 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49182 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49216 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49205 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49223 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49187 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49228 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49235 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49197 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49229 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49212 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49230 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49222 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49211 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49237 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49199 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49226 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49215 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49238 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49217 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49231 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49220 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49218 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49233 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49221 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49234 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49224 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49227 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49225 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49236 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49239 -> 185.196.11.252:1998 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .gfids
description svcs.exe tried to sleep 426 seconds, actually delayed analysis time by 426 seconds
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-3XK1S0 reg_value "C:\Users\test22\AppData\Roaming\microsofts\svcs.exe"
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-3XK1S0 reg_value "C:\Users\test22\AppData\Roaming\microsofts\svcs.exe"
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-3XK1S0 reg_value "C:\Users\test22\AppData\Roaming\microsofts\svcs.exe"
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-3XK1S0 reg_value "C:\Users\test22\AppData\Roaming\microsofts\svcs.exe"
Time & API Arguments Status Return Repeated

SetWindowsHookExA

 thread_identifier: 0
callback_function: 0x0040a2a4
hook_identifier: 13 (WH_KEYBOARD_LL)
module_address: 0x00400000
1 721311 0
Bkav W32.Common.111DAF76
Lionic Trojan.Win32.Remcos.m!c
Elastic Windows.Trojan.Remcos
Cynet Malicious (score: 100)
CAT-QuickHeal Backdoor.RemcosIH.S31010159
Skyhigh BehavesLike.Win32.Remcos.gh
ALYac Trojan.GenericKD.72165769
Cylance unsafe
VIPRE Trojan.GenericKD.72165769
Sangfor Trojan.Win32.Save.a
K7AntiVirus Riskware ( 00584baa1 )
BitDefender Trojan.GenericKD.72165769
K7GW Riskware ( 00584baa1 )
Arcabit Trojan.Generic.D44D2989
Baidu Win32.Trojan.Kryptik.awm
VirIT Trojan.Win32.Genus.UED
Symantec Trojan Horse
ESET-NOD32 Win32/Rescoms.V
APEX Malicious
McAfee Remcos-FDQO!06F5B8DFFC6C
Avast Win32:RATX-gen [Trj]
ClamAV Win.Trojan.Remcos-9841897-0
Kaspersky HEUR:Backdoor.Win32.Remcos.gen
Alibaba Backdoor:Win32/Remcos.8894472e
NANO-Antivirus Trojan.Win32.Remcos.keikbt
SUPERAntiSpyware Trojan.Agent/Gen-Remcos
MicroWorld-eScan Trojan.GenericKD.72165769
Rising Backdoor.Remcos!1.BAC7 (CLASSIC)
Emsisoft Trojan.GenericKD.72165769 (B)
F-Secure Backdoor.BDS/Backdoor.Gen
DrWeb Trojan.Siggen22.19832
Zillya Trojan.Rescoms.Win32.1521
TrendMicro Backdoor.Win32.REMCOS.YXEC3Z
FireEye Generic.mg.06f5b8dffc6c1388
Sophos Mal/Remcos-B
Ikarus Backdoor.Remcos
Jiangmin Backdoor.Remcos.dyc
Webroot W32.Trojan.Remcos
Google Detected
Avira BDS/Backdoor.Gen
MAX malware (ai score=83)
Antiy-AVL Trojan[Backdoor]/Win32.Rescoms.b
Kingsoft Win32.Hack.Remcos.gen
Gridinsoft Trojan.Win32.Remcos.tr
Microsoft Trojan:Win32/Remcos.ARM!MTB
ViRobot Trojan.Win.Z.Remcos.494592.LK
ZoneAlarm HEUR:Backdoor.Win32.Remcos.gen
GData Win32.Trojan.PSE.1OHYAG0
Varist W32/Trojan.SMWB-4856
AhnLab-V3 Backdoor/Win.Remcos.R625673