Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows10_x64 -
resource
win10 -
submitted
07/07/2020, 09:12
Static task
static1
Behavioral task
behavioral1
Sample
Shipment Document BL,INV and packing list.jpg.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Shipment Document BL,INV and packing list.jpg.exe
Resource
win10
0 signatures
0 seconds
General
-
Target
Shipment Document BL,INV and packing list.jpg.exe
-
Size
659KB
-
MD5
fe59b9e260519d6227ff7e239c9d0a04
-
SHA1
577f9d0d5fd671a83caad0cfe241fbf724d372fc
-
SHA256
57294ac308436e17b7e99da25f3d0fa1eb0a466572bed8ee736e078d0dc8042f
-
SHA512
30f90794a594bb0f68f04089f4f367d7251e24c25d073386eb6f2df7d847d558ea859d4404632d069041ac0157952db95f13e064fef5f3a968dd227a341eea59
Score
10/10
Malware Config
Extracted
Family
remcos
C2
hussanm.duckdns.org:7652
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3772 remcos.exe 4056 remcos.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4056 remcos.exe -
Adds Run entry to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\ Shipment Document BL,INV and packing list.jpg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" Shipment Document BL,INV and packing list.jpg.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\ remcos.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" remcos.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3568 PING.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3632 Shipment Document BL,INV and packing list.jpg.exe 3632 Shipment Document BL,INV and packing list.jpg.exe 3772 remcos.exe 3772 remcos.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3632 wrote to memory of 3828 3632 Shipment Document BL,INV and packing list.jpg.exe 67 PID 3632 wrote to memory of 3828 3632 Shipment Document BL,INV and packing list.jpg.exe 67 PID 3632 wrote to memory of 3828 3632 Shipment Document BL,INV and packing list.jpg.exe 67 PID 3828 wrote to memory of 3836 3828 Shipment Document BL,INV and packing list.jpg.exe 68 PID 3828 wrote to memory of 3836 3828 Shipment Document BL,INV and packing list.jpg.exe 68 PID 3828 wrote to memory of 3836 3828 Shipment Document BL,INV and packing list.jpg.exe 68 PID 3836 wrote to memory of 3568 3836 cmd.exe 70 PID 3836 wrote to memory of 3568 3836 cmd.exe 70 PID 3836 wrote to memory of 3568 3836 cmd.exe 70 PID 3836 wrote to memory of 3772 3836 cmd.exe 71 PID 3836 wrote to memory of 3772 3836 cmd.exe 71 PID 3836 wrote to memory of 3772 3836 cmd.exe 71 PID 3772 wrote to memory of 4056 3772 remcos.exe 72 PID 3772 wrote to memory of 4056 3772 remcos.exe 72 PID 3772 wrote to memory of 4056 3772 remcos.exe 72 -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 3632 Shipment Document BL,INV and packing list.jpg.exe 3772 remcos.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3632 set thread context of 3828 3632 Shipment Document BL,INV and packing list.jpg.exe 67 PID 3772 set thread context of 4056 3772 remcos.exe 72 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4056 remcos.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and packing list.jpg.exe"C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and packing list.jpg.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and packing list.jpg.exe"C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and packing list.jpg.exe"2⤵
- Adds Run entry to start application
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Windows\SysWOW64\PING.EXEPING 127.0.0.1 -n 24⤵
- Runs ping.exe
PID:3568
-
-
C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:3772 -
C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Adds Run entry to start application
- Suspicious behavior: GetForegroundWindowSpam
PID:4056
-
-
-
-