Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
11/01/2024, 12:52
Static task
static1
Behavioral task
behavioral1
Sample
5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4.exe
Resource
win10v2004-20231215-en
General
-
Target
5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4.exe
-
Size
885KB
-
MD5
a97f1c6922b2b559c7f9c5114f1b59c3
-
SHA1
40fcc0e5f3b23349d5d96a1563948ebe155f9fa9
-
SHA256
5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4
-
SHA512
158208563fe97ecdb4a67b148360081571823d512cb3339be329ee36f47038d312c15457dc32b0fb6fe82b9e670a036c19b399b2c434d684fa1ddd06de530d2d
-
SSDEEP
24576:R+f55qeCiUlgtCg0mEk4Q2oPYYaeu5gUJZ8y:Yf55CJK4mEk4Q2oQYDSpJZ
Malware Config
Extracted
remcos
RemoteHost
167.114.189.33:2404
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-7ZDF66
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1968 set thread context of 2620 1968 5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4.exe 30 -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2620 5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1968 wrote to memory of 2620 1968 5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4.exe 30 PID 1968 wrote to memory of 2620 1968 5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4.exe 30 PID 1968 wrote to memory of 2620 1968 5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4.exe 30 PID 1968 wrote to memory of 2620 1968 5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4.exe 30 PID 1968 wrote to memory of 2620 1968 5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4.exe 30 PID 1968 wrote to memory of 2620 1968 5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4.exe 30 PID 1968 wrote to memory of 2620 1968 5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4.exe 30 PID 1968 wrote to memory of 2620 1968 5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4.exe 30 PID 1968 wrote to memory of 2620 1968 5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4.exe 30 PID 1968 wrote to memory of 2620 1968 5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4.exe 30 PID 1968 wrote to memory of 2620 1968 5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4.exe 30 PID 1968 wrote to memory of 2620 1968 5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4.exe 30 PID 1968 wrote to memory of 2620 1968 5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4.exe"C:\Users\Admin\AppData\Local\Temp\5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4.exe"C:\Users\Admin\AppData\Local\Temp\5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:2620
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5ee689b7bfc7097e62a946cb3ff1ac90f
SHA16157f8835f130b4ade7b5a9df9d142f0387a73ab
SHA25643425bddc1610c1601f755c34682d373321e55f32e4b173efde07b2f2ea6e8ea
SHA5120d74f7f7b5ff483df12f1ea168778d1ba06e83aa3473f7da84b2b20e8563fea92e57e928946929cbea39bf849ed0936e3b6eb194398de3e005d8a1c424e556c6