Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
08/02/2023, 15:49
Static task
static1
Behavioral task
behavioral1
Sample
slpr.exe
Resource
win10-20220812-en
General
-
Target
slpr.exe
-
Size
300.0MB
-
MD5
5c94b9f981e63a440a7a40971a9c2d36
-
SHA1
0df6bc0f2f497bb0cd935fb00433bead94f6d28b
-
SHA256
e3ae3157428659c73519c6eceb3066f5b0261e006d574b039c15c6b54abbea1a
-
SHA512
40f3eb162834b819b583dcced66646763c18cf8b92d14ca8b6a1ec0ea020e14e2076da69cf3637bee7ed6b62e342106bd8846a121ee49d1f47735b3560c63d5d
-
SSDEEP
12288:Yog+f66nQlAI0FBX+OeKUPrrQ84BPBRMTSUfXJuSMZdnh0TBnms:YX+yyQlh0FOzrF7T3vJUTnh0TF
Malware Config
Extracted
remcos
CASAMAMI
casamami.con-ip.com:7770
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-2JJVDI
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2308 slpr.exe 760 slpr.exe 4408 slpr.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 3528 set thread context of 2148 3528 slpr.exe 66 PID 2308 set thread context of 4348 2308 slpr.exe 77 PID 760 set thread context of 3852 760 slpr.exe 87 PID 4408 set thread context of 2640 4408 slpr.exe 97 -
Program crash 4 IoCs
pid pid_target Process procid_target 1724 2148 WerFault.exe 66 4664 4348 WerFault.exe 77 4308 3852 WerFault.exe 87 1884 2640 WerFault.exe 97 -
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1188 schtasks.exe 4388 schtasks.exe 584 schtasks.exe 4292 schtasks.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3528 wrote to memory of 2148 3528 slpr.exe 66 PID 3528 wrote to memory of 2148 3528 slpr.exe 66 PID 3528 wrote to memory of 2148 3528 slpr.exe 66 PID 3528 wrote to memory of 2148 3528 slpr.exe 66 PID 3528 wrote to memory of 2148 3528 slpr.exe 66 PID 3528 wrote to memory of 2148 3528 slpr.exe 66 PID 3528 wrote to memory of 2148 3528 slpr.exe 66 PID 3528 wrote to memory of 2148 3528 slpr.exe 66 PID 3528 wrote to memory of 2148 3528 slpr.exe 66 PID 3528 wrote to memory of 2148 3528 slpr.exe 66 PID 3528 wrote to memory of 2148 3528 slpr.exe 66 PID 3528 wrote to memory of 2148 3528 slpr.exe 66 PID 3528 wrote to memory of 4812 3528 slpr.exe 67 PID 3528 wrote to memory of 4812 3528 slpr.exe 67 PID 3528 wrote to memory of 4812 3528 slpr.exe 67 PID 3528 wrote to memory of 4852 3528 slpr.exe 68 PID 3528 wrote to memory of 4852 3528 slpr.exe 68 PID 3528 wrote to memory of 4852 3528 slpr.exe 68 PID 3528 wrote to memory of 4892 3528 slpr.exe 69 PID 3528 wrote to memory of 4892 3528 slpr.exe 69 PID 3528 wrote to memory of 4892 3528 slpr.exe 69 PID 4852 wrote to memory of 4388 4852 cmd.exe 73 PID 4852 wrote to memory of 4388 4852 cmd.exe 73 PID 4852 wrote to memory of 4388 4852 cmd.exe 73 PID 2308 wrote to memory of 4348 2308 slpr.exe 77 PID 2308 wrote to memory of 4348 2308 slpr.exe 77 PID 2308 wrote to memory of 4348 2308 slpr.exe 77 PID 2308 wrote to memory of 4348 2308 slpr.exe 77 PID 2308 wrote to memory of 4348 2308 slpr.exe 77 PID 2308 wrote to memory of 4348 2308 slpr.exe 77 PID 2308 wrote to memory of 4348 2308 slpr.exe 77 PID 2308 wrote to memory of 4348 2308 slpr.exe 77 PID 2308 wrote to memory of 4348 2308 slpr.exe 77 PID 2308 wrote to memory of 4348 2308 slpr.exe 77 PID 2308 wrote to memory of 4348 2308 slpr.exe 77 PID 2308 wrote to memory of 4348 2308 slpr.exe 77 PID 2308 wrote to memory of 4364 2308 slpr.exe 80 PID 2308 wrote to memory of 4364 2308 slpr.exe 80 PID 2308 wrote to memory of 4364 2308 slpr.exe 80 PID 2308 wrote to memory of 2040 2308 slpr.exe 79 PID 2308 wrote to memory of 2040 2308 slpr.exe 79 PID 2308 wrote to memory of 2040 2308 slpr.exe 79 PID 2308 wrote to memory of 2872 2308 slpr.exe 78 PID 2308 wrote to memory of 2872 2308 slpr.exe 78 PID 2308 wrote to memory of 2872 2308 slpr.exe 78 PID 2040 wrote to memory of 584 2040 cmd.exe 85 PID 2040 wrote to memory of 584 2040 cmd.exe 85 PID 2040 wrote to memory of 584 2040 cmd.exe 85 PID 760 wrote to memory of 3852 760 slpr.exe 87 PID 760 wrote to memory of 3852 760 slpr.exe 87 PID 760 wrote to memory of 3852 760 slpr.exe 87 PID 760 wrote to memory of 3852 760 slpr.exe 87 PID 760 wrote to memory of 3852 760 slpr.exe 87 PID 760 wrote to memory of 3852 760 slpr.exe 87 PID 760 wrote to memory of 3852 760 slpr.exe 87 PID 760 wrote to memory of 3852 760 slpr.exe 87 PID 760 wrote to memory of 3852 760 slpr.exe 87 PID 760 wrote to memory of 3852 760 slpr.exe 87 PID 760 wrote to memory of 3852 760 slpr.exe 87 PID 760 wrote to memory of 3852 760 slpr.exe 87 PID 760 wrote to memory of 60 760 slpr.exe 90 PID 760 wrote to memory of 60 760 slpr.exe 90 PID 760 wrote to memory of 60 760 slpr.exe 90 PID 760 wrote to memory of 340 760 slpr.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\slpr.exe"C:\Users\Admin\AppData\Local\Temp\slpr.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"2⤵PID:2148
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 5203⤵
- Program crash
PID:1724
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\slpr"2⤵PID:4812
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\slpr\slpr.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\slpr\slpr.exe'" /f3⤵
- Creates scheduled task(s)
PID:4388
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\slpr.exe" "C:\Users\Admin\AppData\Roaming\slpr\slpr.exe"2⤵PID:4892
-
-
C:\Users\Admin\AppData\Roaming\slpr\slpr.exeC:\Users\Admin\AppData\Roaming\slpr\slpr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"2⤵PID:4348
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4348 -s 5203⤵
- Program crash
PID:4664
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\slpr\slpr.exe" "C:\Users\Admin\AppData\Roaming\slpr\slpr.exe"2⤵PID:2872
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\slpr\slpr.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\slpr\slpr.exe'" /f3⤵
- Creates scheduled task(s)
PID:584
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\slpr"2⤵PID:4364
-
-
C:\Users\Admin\AppData\Roaming\slpr\slpr.exeC:\Users\Admin\AppData\Roaming\slpr\slpr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"2⤵PID:3852
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 5203⤵
- Program crash
PID:4308
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\slpr\slpr.exe" "C:\Users\Admin\AppData\Roaming\slpr\slpr.exe"2⤵PID:3860
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\slpr\slpr.exe'" /f2⤵PID:340
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\slpr\slpr.exe'" /f3⤵
- Creates scheduled task(s)
PID:4292
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\slpr"2⤵PID:60
-
-
C:\Users\Admin\AppData\Roaming\slpr\slpr.exeC:\Users\Admin\AppData\Roaming\slpr\slpr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4408 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"2⤵PID:2640
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 5203⤵
- Program crash
PID:1884
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\slpr"2⤵PID:4632
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\slpr\slpr.exe" "C:\Users\Admin\AppData\Roaming\slpr\slpr.exe"2⤵PID:3180
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\slpr\slpr.exe'" /f2⤵PID:3164
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\slpr\slpr.exe'" /f3⤵
- Creates scheduled task(s)
PID:1188
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
517B
MD59761874a4acfb68118be1889a518347a
SHA1b6f2fd709c0e36d0ab4865880f76d9a56e519274
SHA25637bb8cfa28f272fcfac5ca7a86770b21d84322cbb8ec67dd07d22cc806073aed
SHA5129b54b174c30ad798cfb19e5ea435198bf815fb77b1b5e50ec5381d30e199a735e4c88dfe5644ae4a31709572ec24ccd04ae54ffe18b52e801a42009d7ed1b35f
-
Filesize
300.0MB
MD55c94b9f981e63a440a7a40971a9c2d36
SHA10df6bc0f2f497bb0cd935fb00433bead94f6d28b
SHA256e3ae3157428659c73519c6eceb3066f5b0261e006d574b039c15c6b54abbea1a
SHA51240f3eb162834b819b583dcced66646763c18cf8b92d14ca8b6a1ec0ea020e14e2076da69cf3637bee7ed6b62e342106bd8846a121ee49d1f47735b3560c63d5d
-
Filesize
300.0MB
MD55c94b9f981e63a440a7a40971a9c2d36
SHA10df6bc0f2f497bb0cd935fb00433bead94f6d28b
SHA256e3ae3157428659c73519c6eceb3066f5b0261e006d574b039c15c6b54abbea1a
SHA51240f3eb162834b819b583dcced66646763c18cf8b92d14ca8b6a1ec0ea020e14e2076da69cf3637bee7ed6b62e342106bd8846a121ee49d1f47735b3560c63d5d
-
Filesize
300.0MB
MD55c94b9f981e63a440a7a40971a9c2d36
SHA10df6bc0f2f497bb0cd935fb00433bead94f6d28b
SHA256e3ae3157428659c73519c6eceb3066f5b0261e006d574b039c15c6b54abbea1a
SHA51240f3eb162834b819b583dcced66646763c18cf8b92d14ca8b6a1ec0ea020e14e2076da69cf3637bee7ed6b62e342106bd8846a121ee49d1f47735b3560c63d5d
-
Filesize
76.1MB
MD50d7f3482ff962d7c47f273096db0e81e
SHA171896ad3a27613b94cb483318d5926e8c5d8f83d
SHA256ab1181895fce7873ca608030c84236449491bfaf8ab42c857c48b486f741c1d4
SHA5126fd20975e8c2303554aed074d285b488a1e0a0f149811622a9da3e83ad0154b3a8a666a6a17ceddb285fa2534cc01421e3104ea73067bfafabf2e803a90d1038