Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    08/02/2023, 15:49

General

  • Target

    slpr.exe

  • Size

    300.0MB

  • MD5

    5c94b9f981e63a440a7a40971a9c2d36

  • SHA1

    0df6bc0f2f497bb0cd935fb00433bead94f6d28b

  • SHA256

    e3ae3157428659c73519c6eceb3066f5b0261e006d574b039c15c6b54abbea1a

  • SHA512

    40f3eb162834b819b583dcced66646763c18cf8b92d14ca8b6a1ec0ea020e14e2076da69cf3637bee7ed6b62e342106bd8846a121ee49d1f47735b3560c63d5d

  • SSDEEP

    12288:Yog+f66nQlAI0FBX+OeKUPrrQ84BPBRMTSUfXJuSMZdnh0TBnms:YX+yyQlh0FOzrF7T3vJUTnh0TF

Score
10/10

Malware Config

Extracted

Family

remcos

Botnet

CASAMAMI

C2

casamami.con-ip.com:7770

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-2JJVDI

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Executes dropped EXE 3 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Program crash 4 IoCs
  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\slpr.exe
    "C:\Users\Admin\AppData\Local\Temp\slpr.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3528
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
      2⤵
        PID:2148
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 520
          3⤵
          • Program crash
          PID:1724
      • C:\Windows\SysWOW64\cmd.exe
        "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\slpr"
        2⤵
          PID:4812
        • C:\Windows\SysWOW64\cmd.exe
          "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\slpr\slpr.exe'" /f
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4852
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\slpr\slpr.exe'" /f
            3⤵
            • Creates scheduled task(s)
            PID:4388
        • C:\Windows\SysWOW64\cmd.exe
          "cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\slpr.exe" "C:\Users\Admin\AppData\Roaming\slpr\slpr.exe"
          2⤵
            PID:4892
        • C:\Users\Admin\AppData\Roaming\slpr\slpr.exe
          C:\Users\Admin\AppData\Roaming\slpr\slpr.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:2308
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
            2⤵
              PID:4348
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4348 -s 520
                3⤵
                • Program crash
                PID:4664
            • C:\Windows\SysWOW64\cmd.exe
              "cmd" /c copy "C:\Users\Admin\AppData\Roaming\slpr\slpr.exe" "C:\Users\Admin\AppData\Roaming\slpr\slpr.exe"
              2⤵
                PID:2872
              • C:\Windows\SysWOW64\cmd.exe
                "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\slpr\slpr.exe'" /f
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:2040
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\slpr\slpr.exe'" /f
                  3⤵
                  • Creates scheduled task(s)
                  PID:584
              • C:\Windows\SysWOW64\cmd.exe
                "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\slpr"
                2⤵
                  PID:4364
              • C:\Users\Admin\AppData\Roaming\slpr\slpr.exe
                C:\Users\Admin\AppData\Roaming\slpr\slpr.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:760
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
                  2⤵
                    PID:3852
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 520
                      3⤵
                      • Program crash
                      PID:4308
                  • C:\Windows\SysWOW64\cmd.exe
                    "cmd" /c copy "C:\Users\Admin\AppData\Roaming\slpr\slpr.exe" "C:\Users\Admin\AppData\Roaming\slpr\slpr.exe"
                    2⤵
                      PID:3860
                    • C:\Windows\SysWOW64\cmd.exe
                      "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\slpr\slpr.exe'" /f
                      2⤵
                        PID:340
                        • C:\Windows\SysWOW64\schtasks.exe
                          schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\slpr\slpr.exe'" /f
                          3⤵
                          • Creates scheduled task(s)
                          PID:4292
                      • C:\Windows\SysWOW64\cmd.exe
                        "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\slpr"
                        2⤵
                          PID:60
                      • C:\Users\Admin\AppData\Roaming\slpr\slpr.exe
                        C:\Users\Admin\AppData\Roaming\slpr\slpr.exe
                        1⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        PID:4408
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
                          2⤵
                            PID:2640
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 520
                              3⤵
                              • Program crash
                              PID:1884
                          • C:\Windows\SysWOW64\cmd.exe
                            "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\slpr"
                            2⤵
                              PID:4632
                            • C:\Windows\SysWOW64\cmd.exe
                              "cmd" /c copy "C:\Users\Admin\AppData\Roaming\slpr\slpr.exe" "C:\Users\Admin\AppData\Roaming\slpr\slpr.exe"
                              2⤵
                                PID:3180
                              • C:\Windows\SysWOW64\cmd.exe
                                "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\slpr\slpr.exe'" /f
                                2⤵
                                  PID:3164
                                  • C:\Windows\SysWOW64\schtasks.exe
                                    schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\slpr\slpr.exe'" /f
                                    3⤵
                                    • Creates scheduled task(s)
                                    PID:1188

                              Network

                              MITRE ATT&CK Enterprise v6

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\slpr.exe.log

                                Filesize

                                517B

                                MD5

                                9761874a4acfb68118be1889a518347a

                                SHA1

                                b6f2fd709c0e36d0ab4865880f76d9a56e519274

                                SHA256

                                37bb8cfa28f272fcfac5ca7a86770b21d84322cbb8ec67dd07d22cc806073aed

                                SHA512

                                9b54b174c30ad798cfb19e5ea435198bf815fb77b1b5e50ec5381d30e199a735e4c88dfe5644ae4a31709572ec24ccd04ae54ffe18b52e801a42009d7ed1b35f

                              • C:\Users\Admin\AppData\Roaming\slpr\slpr.exe

                                Filesize

                                300.0MB

                                MD5

                                5c94b9f981e63a440a7a40971a9c2d36

                                SHA1

                                0df6bc0f2f497bb0cd935fb00433bead94f6d28b

                                SHA256

                                e3ae3157428659c73519c6eceb3066f5b0261e006d574b039c15c6b54abbea1a

                                SHA512

                                40f3eb162834b819b583dcced66646763c18cf8b92d14ca8b6a1ec0ea020e14e2076da69cf3637bee7ed6b62e342106bd8846a121ee49d1f47735b3560c63d5d

                              • C:\Users\Admin\AppData\Roaming\slpr\slpr.exe

                                Filesize

                                300.0MB

                                MD5

                                5c94b9f981e63a440a7a40971a9c2d36

                                SHA1

                                0df6bc0f2f497bb0cd935fb00433bead94f6d28b

                                SHA256

                                e3ae3157428659c73519c6eceb3066f5b0261e006d574b039c15c6b54abbea1a

                                SHA512

                                40f3eb162834b819b583dcced66646763c18cf8b92d14ca8b6a1ec0ea020e14e2076da69cf3637bee7ed6b62e342106bd8846a121ee49d1f47735b3560c63d5d

                              • C:\Users\Admin\AppData\Roaming\slpr\slpr.exe

                                Filesize

                                300.0MB

                                MD5

                                5c94b9f981e63a440a7a40971a9c2d36

                                SHA1

                                0df6bc0f2f497bb0cd935fb00433bead94f6d28b

                                SHA256

                                e3ae3157428659c73519c6eceb3066f5b0261e006d574b039c15c6b54abbea1a

                                SHA512

                                40f3eb162834b819b583dcced66646763c18cf8b92d14ca8b6a1ec0ea020e14e2076da69cf3637bee7ed6b62e342106bd8846a121ee49d1f47735b3560c63d5d

                              • C:\Users\Admin\AppData\Roaming\slpr\slpr.exe

                                Filesize

                                76.1MB

                                MD5

                                0d7f3482ff962d7c47f273096db0e81e

                                SHA1

                                71896ad3a27613b94cb483318d5926e8c5d8f83d

                                SHA256

                                ab1181895fce7873ca608030c84236449491bfaf8ab42c857c48b486f741c1d4

                                SHA512

                                6fd20975e8c2303554aed074d285b488a1e0a0f149811622a9da3e83ad0154b3a8a666a6a17ceddb285fa2534cc01421e3104ea73067bfafabf2e803a90d1038

                              • memory/2148-166-0x0000000000400000-0x0000000000480000-memory.dmp

                                Filesize

                                512KB

                              • memory/2148-185-0x0000000005040000-0x00000000050C0000-memory.dmp

                                Filesize

                                512KB

                              • memory/2148-169-0x0000000005040000-0x00000000050C0000-memory.dmp

                                Filesize

                                512KB

                              • memory/2148-168-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-160-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-131-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-139-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-141-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-140-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-142-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-143-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-144-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-145-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-146-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-147-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-148-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-149-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-150-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-151-0x0000000000390000-0x0000000000448000-memory.dmp

                                Filesize

                                736KB

                              • memory/3528-152-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-153-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-154-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-155-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-156-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-157-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-158-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-159-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-118-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-161-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-162-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-163-0x0000000004C10000-0x0000000004C76000-memory.dmp

                                Filesize

                                408KB

                              • memory/3528-164-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-165-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-137-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-136-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-119-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-120-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-121-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-122-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-123-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-124-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-180-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-125-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-126-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-127-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-135-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-134-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-129-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-128-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-130-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-133-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-138-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3528-132-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4812-179-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4812-173-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4812-184-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4812-177-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4852-183-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4852-178-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4852-187-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4892-182-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4892-186-0x0000000077550000-0x00000000776DE000-memory.dmp

                                Filesize

                                1.6MB