Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2023, 01:29
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.6184ff3443ec7a285593273a59becfc0.exe
Resource
win7-20231023-en
General
-
Target
NEAS.6184ff3443ec7a285593273a59becfc0.exe
-
Size
1.2MB
-
MD5
6184ff3443ec7a285593273a59becfc0
-
SHA1
d66612979540afa05e77efc6b8ed527646da0bf8
-
SHA256
7fdaa2d9014b7ec1f7c9b851651909d1b4a137276376e1436c359ce435c18db2
-
SHA512
fcd24e33e79717502155363617ae082845951e165b0f1d96322d261606af84013d95b674133c11c597f66a8a4154dd5561ada33fd7c92091ae9e9fa85ade5315
-
SSDEEP
24576:1zcVdHBFT7bZsai6apMRE+2tA5JiQbSavT7BXZ7:1zcVrFPbZsaOMRUtALiaSavT1XZ7
Malware Config
Extracted
remcos
kill
tincaanii.duckdns.org:24113
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-KCRM7J
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Control Panel\International\Geo\Nation NEAS.6184ff3443ec7a285593273a59becfc0.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5028 set thread context of 2016 5028 NEAS.6184ff3443ec7a285593273a59becfc0.exe 102 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1008 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 5028 NEAS.6184ff3443ec7a285593273a59becfc0.exe 5028 NEAS.6184ff3443ec7a285593273a59becfc0.exe 5028 NEAS.6184ff3443ec7a285593273a59becfc0.exe 5028 NEAS.6184ff3443ec7a285593273a59becfc0.exe 5028 NEAS.6184ff3443ec7a285593273a59becfc0.exe 3208 powershell.exe 3208 powershell.exe 3208 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 5028 NEAS.6184ff3443ec7a285593273a59becfc0.exe Token: SeDebugPrivilege 3208 powershell.exe Token: SeManageVolumePrivilege 3888 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2016 NEAS.6184ff3443ec7a285593273a59becfc0.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 5028 wrote to memory of 3208 5028 NEAS.6184ff3443ec7a285593273a59becfc0.exe 98 PID 5028 wrote to memory of 3208 5028 NEAS.6184ff3443ec7a285593273a59becfc0.exe 98 PID 5028 wrote to memory of 3208 5028 NEAS.6184ff3443ec7a285593273a59becfc0.exe 98 PID 5028 wrote to memory of 1008 5028 NEAS.6184ff3443ec7a285593273a59becfc0.exe 100 PID 5028 wrote to memory of 1008 5028 NEAS.6184ff3443ec7a285593273a59becfc0.exe 100 PID 5028 wrote to memory of 1008 5028 NEAS.6184ff3443ec7a285593273a59becfc0.exe 100 PID 5028 wrote to memory of 2016 5028 NEAS.6184ff3443ec7a285593273a59becfc0.exe 102 PID 5028 wrote to memory of 2016 5028 NEAS.6184ff3443ec7a285593273a59becfc0.exe 102 PID 5028 wrote to memory of 2016 5028 NEAS.6184ff3443ec7a285593273a59becfc0.exe 102 PID 5028 wrote to memory of 2016 5028 NEAS.6184ff3443ec7a285593273a59becfc0.exe 102 PID 5028 wrote to memory of 2016 5028 NEAS.6184ff3443ec7a285593273a59becfc0.exe 102 PID 5028 wrote to memory of 2016 5028 NEAS.6184ff3443ec7a285593273a59becfc0.exe 102 PID 5028 wrote to memory of 2016 5028 NEAS.6184ff3443ec7a285593273a59becfc0.exe 102 PID 5028 wrote to memory of 2016 5028 NEAS.6184ff3443ec7a285593273a59becfc0.exe 102 PID 5028 wrote to memory of 2016 5028 NEAS.6184ff3443ec7a285593273a59becfc0.exe 102 PID 5028 wrote to memory of 2016 5028 NEAS.6184ff3443ec7a285593273a59becfc0.exe 102 PID 5028 wrote to memory of 2016 5028 NEAS.6184ff3443ec7a285593273a59becfc0.exe 102 PID 5028 wrote to memory of 2016 5028 NEAS.6184ff3443ec7a285593273a59becfc0.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.6184ff3443ec7a285593273a59becfc0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.6184ff3443ec7a285593273a59becfc0.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\UinnfI.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3208
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UinnfI" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEFAF.tmp"2⤵
- Creates scheduled task(s)
PID:1008
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.6184ff3443ec7a285593273a59becfc0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.6184ff3443ec7a285593273a59becfc0.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:2016
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵PID:4536
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3888
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5fc9e15ea3d76549a9b0f7511ca92aa70
SHA1af1b8d0644d7313ffc98b937a5c009fda5c82baa
SHA2562396ef380493fbac1a370f5f7e38781b86e8652389b11abd804aea391831d4fa
SHA51238795608aa2d5b68f9f172a43acf25735a49a41fc8fb142a79d57b74dbc9d900e87a5f9499c990dca342addc701c75183e0a749ab2dd5dc7ac59d7c1fded9e8d
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD50031767051f55790c30a249c98096d54
SHA17f61f64178ee04a08b043763d81651269b46409f
SHA256c30fa16b75394356e4b9de67951b520cdde850e5f76e2128a82f7f1f124a14bc
SHA512157c0c186526b78b950c067c76767c1ec133f1760c8e074454c0943b8d41129a51080d86e621596ccc14123b3479516bc48c3d54899a30c781bee85e2ff24ffd