Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
Stmt 2024-01.exe
-
Size
1.5MB
-
Sample
240119-w213zabhc3
-
MD5
fe658ad9c31ff2b67f90178b00c48ecc
-
SHA1
1a066197e1e243409ef8cb70b9d71bf5a5a80f05
-
SHA256
6778fea0bea7bd311fbda7b2f6257a7826733a664199d8073c878e401ba20a33
-
SHA512
468fba52d876a39e1e72ea82f8a70dd758dd2c1e99e31dfe226749f3fbc49e64f635b8282e987e71f3b0b872842e61be016bfc24c9fc4592d3dbb8b5d8822f69
-
SSDEEP
24576:pA9PI47mMe3qTK/MYnyXXQ9cgAwFrDsRMzOFlB6WXg/jz8sleGu2bh:c2MYy6cqdDQSOFJg/jiwbh
Static task
static1
Behavioral task
behavioral1
Sample
Stmt 2024-01.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Stmt 2024-01.exe
Resource
win10-20231215-en
Behavioral task
behavioral3
Sample
Stmt 2024-01.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
remcos
RemoteHost
meetre1ms.freeddns.org:2404
mysmeetr.ddns.net:2404
myumysmeetr.ddns.net:2404
bbhmeetre1ms.freeddns.org:2404
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
hsgddj
-
mouse_option
false
-
mutex
WIN2024-GUC4V0
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
Stmt 2024-01.exe
-
Size
1.5MB
-
MD5
fe658ad9c31ff2b67f90178b00c48ecc
-
SHA1
1a066197e1e243409ef8cb70b9d71bf5a5a80f05
-
SHA256
6778fea0bea7bd311fbda7b2f6257a7826733a664199d8073c878e401ba20a33
-
SHA512
468fba52d876a39e1e72ea82f8a70dd758dd2c1e99e31dfe226749f3fbc49e64f635b8282e987e71f3b0b872842e61be016bfc24c9fc4592d3dbb8b5d8822f69
-
SSDEEP
24576:pA9PI47mMe3qTK/MYnyXXQ9cgAwFrDsRMzOFlB6WXg/jz8sleGu2bh:c2MYy6cqdDQSOFJg/jiwbh
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage
-
Creates new service(s)
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1