top title background image
flash

SBG-1100319PurchaseOrder.exe

Status: finished
Submission Time: 2021-04-15 21:36:29 +02:00
Malicious
Ransomware
Trojan
Spyware
Evader
Remcos GuLoader

Comments

Tags

  • exe
  • RAT
  • RemcosRAT

Details

  • Analysis ID:
    388089
  • API (Web) ID:
    678273
  • Analysis Started:
    2021-04-15 21:36:31 +02:00
  • Analysis Finished:
    2021-04-15 21:45:15 +02:00
  • MD5:
    2dd62d78b9f7e9c5529502e085b55756
  • SHA1:
    151d4cd68958df35ae706cc232627a05e923307f
  • SHA256:
    c63a3f86be406a11e8f7760403e407a97441753205f8cef432fd634856ca2992
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

IPs

IP Country Detection
79.134.225.124
Switzerland

Domains

Name IP Detection
sheilabeltagy4m.hopto.org
79.134.225.124
micheal3m.hopto.org
79.134.225.124
onedrive.live.com
0.0.0.0
Click to see the 1 hidden entries
vug8la.am.files.1drv.com
0.0.0.0

URLs

Name Detection
https://onedrive.live.com/b
https://vug8la.am.files.1drv.com/y4mT1QYIp_fyTE8Fy0lLLYF_0s99rPZfbzgWA1b5QlZt4eQwn4RVNktZv9qdlLB64Ai
https://onedrive.live.com/download?cid=1685231EC8E4EC43&resid=1685231EC8E4EC43%21505&authkey=ANKqoxx
Click to see the 3 hidden entries
https://vug8la.am.files.1drv.com/
https://onedrive.live.com/
https://onedrive.live.com/download?cid=1685231EC8E4EC43&resid=1685231EC8E4EC43%2

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Temp\subfolder1\filename1.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\subfolder1\filename1.vbs
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Roaming\remcos\logs.dat
data
#