top title background image
flash

New Doc 20211401#_our new price.exe

Status: finished
Submission Time: 2021-01-21 07:18:45 +01:00
Malicious
Trojan
Evader
Remcos GuLoader

Comments

Tags

  • exe
  • nVpn
  • RAT
  • RemcosRAT

Details

  • Analysis ID:
    342481
  • API (Web) ID:
    586916
  • Analysis Started:
    2021-01-21 07:22:53 +01:00
  • Analysis Finished:
    2021-01-21 07:32:35 +01:00
  • MD5:
    14a7ac7e8a7cc68ee2040ea5f3bb145e
  • SHA1:
    e7eabd570ec2dce1203d013a11599a8c627b527a
  • SHA256:
    cb3e82e9c93c6b7b44dd782d26d22ad26f323176f8662642397d6d271754768d
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

malicious
Score: 6/46

IPs

IP Country Detection
91.193.75.243
Serbia

Domains

Name IP Detection
oluchi.ddns.net
91.193.75.243
g.msn.com
0.0.0.0
onedrive.live.com
0.0.0.0
Click to see the 1 hidden entries
fkteua.db.files.1drv.com
0.0.0.0

URLs

Name Detection
https://fkteua.db.files.1drv.com/
https://onedrive.live.com/download?cid=A32AEA2B4355716B&resid=A32AEA2B4355716B%215171&authkey=APwe6-
http://crl3.digi
Click to see the 3 hidden entries
https://fkteua.db.files.1drv.com/y4m1K5aXO_hTJZwQ6sRUBeX3MwbIRGCEyLmUsy6a-Tv86ILmUxMJD16_BkowRYABW7o
https://onedrive.live.com/
https://fkteua.db.files.1drv.com/y4m7jo0uscLY3JGQOA8WNtz0kE6mECzmykD9EyNeCFL_ih_emej5aweglDZjRx1WKGH

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Temp\Strikkebgernes\Indtastningsfacilitet.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\Strikkebgernes\Indtastningsfacilitet.vbs
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Roaming\remcos\logs.dat
ASCII text, with CRLF line terminators
#