Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
01/02/2023, 17:02
230201-vj6p3aah39 1001/02/2023, 17:00
230201-vjf5eacg4s 1001/02/2023, 16:57
230201-vgbrxacg2y 10Analysis
-
max time kernel
151s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
01/02/2023, 16:57
General
-
Target
DHL SHIPPING DOC PDF.exe
-
Size
1.0MB
-
MD5
6d452842eeb2efa505763049d59c553a
-
SHA1
e13f2202155e12573a985b5df24319e5320f588e
-
SHA256
52e2a0d6ec4940ac71db48d62f8de4fa9ea7ea4a0abfaff91175ea2e0ec0d998
-
SHA512
c37faf01a77690351e6cd47196821dddca39a3df07a9286b17e2916fc107429ddadc5dc9fa695bfb52ab8105a1e41b1367c6d68472dac64ecb47f9a9be4add54
-
SSDEEP
24576:uL5mA6W5L4EAyxtiH5wkm99RtPK7TQXQyRU5JqG4yPa:eJ41OtiH5wbbRucXQyRU8
Malware Config
Extracted
remcos
RemoteHost
51.75.209.245:2406
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-52YOYG
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL SHIPPING DOC PDF.exe"C:\Users\Admin\AppData\Local\Temp\DHL SHIPPING DOC PDF.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\DHL SHIPPING DOC PDF.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gpnAwW.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gpnAwW" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9A8A.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\DHL SHIPPING DOC PDF.exe"C:\Users\Admin\AppData\Local\Temp\DHL SHIPPING DOC PDF.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
18KB
MD5375a01de572727008c9b3514842fa011
SHA1d6549314d5992400ee44213b9f11748a0b26fff6
SHA2562e17d15658d8f45d517cfb543a42e40a51c0425d5dbb0e0000e379ef60149628
SHA512b775320adeb4e7c180939162ec4cdedc4e91d2e1bf266cdff45ec572b4bbbc874bbd18f470f6a352bfa3d16303c66a1948477dd0327bff2e541b93724cddf0a3
-
Filesize
1KB
MD54ac184107864d7680f5b49f1557815c5
SHA1b11f395985df173b3a8a158e8055561f8a19ebaf
SHA2565673882ecc992d0914d928b6080e4bb9837639cbea9ece12fa571b1d7c39756f
SHA51236cfcf9a3eced9b496e995771e00fee31b29fe08ef6e00c029895a140211f3e77d2dce01132c56c7b334649c79e9ca9e35e1f2432a512fe78cdd7bab783d2f98
-
Filesize
40KB
-
Filesize
624KB
-
Filesize
584KB
-
Filesize
1.0MB
-
Filesize
5.6MB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
6.5MB
-
Filesize
408KB
-
Filesize
104KB
-
Filesize
56KB
-
Filesize
6.2MB
-
Filesize
40KB
-
Filesize
304KB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
216KB
-
Filesize
104KB
-
Filesize
200KB
-
Filesize
600KB
-
Filesize
120KB
-
Filesize
408KB
-
Filesize
32KB
-
Filesize
136KB