Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

PROCESO DE...4..exe

windows7-x64

10

PROCESO DE...4..exe

windows10-2004-x64

10

Analysis

  • max time kernel
    185s
  • max time network
    189s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/03/2024, 21:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    PROCESO DEMANDA. REF; 3456980012-770-2024..exe

  • Size

    1023.9MB

  • MD5

    76d8531f558cf1e45387137a1b91670f

  • SHA1

    82a4a9a3369c7b5610c38cf68cdee4c43f21d323

  • SHA256

    bf20c21df71040b3cf3b9ad5ce6fb0d97fceccdb9e9d547a80d9f5abe46437ca

  • SHA512

    4b14d8ca43790fc3680cde1094017fe81f9eec204b7f7c3c9bfe0e1694683bd6e0e3fd752bae04fb0f20f7fa3da0bfe3731549da1bf18132fdf6a9bf8beb7d3a

  • SSDEEP

    12288:4GBgEAeHszumED9CS8RwvWV9fV8S4Y2QYFz43VxRW:hBgEApqmWmwE9fiBj8fRW

Score
10/10
remcosjordanrat

Malware Config

Extracted

Family

remcos

Botnet

JORDAN

C2

amapola.con-ip.com:7770

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-YTQPQ7

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PROCESO DEMANDA. REF; 3456980012-770-2024..exe
    "C:\Users\Admin\AppData\Local\Temp\PROCESO DEMANDA. REF; 3456980012-770-2024..exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4500
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
      2⤵
        PID:3444
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3444 -s 512
          3⤵
          • Program crash
          PID:4380
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\AppData"
        2⤵
          PID:1380
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /C schtasks /create /sc minute /mo 10 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\AppData\AppData.exe'" /f
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5084
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /sc minute /mo 10 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\AppData\AppData.exe'" /f
            3⤵
            • Creates scheduled task(s)
            PID:4768
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\PROCESO DEMANDA. REF; 3456980012-770-2024..exe" "C:\Users\Admin\AppData\Roaming\AppData\AppData.exe"
          2⤵
            PID:3052
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3444 -ip 3444
          1⤵
            PID:1604

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/3444-4-0x0000000000F00000-0x0000000000F82000-memory.dmp

            Filesize

            520KB

            Download

          • memory/3444-9-0x0000000000F00000-0x0000000000F82000-memory.dmp

            Filesize

            520KB

            Download

          • memory/3444-14-0x0000000000F00000-0x0000000000F82000-memory.dmp

            Filesize

            520KB

            Download

          • memory/4500-0-0x0000000000760000-0x00000000007EA000-memory.dmp

            Filesize

            552KB

            Download

          • memory/4500-1-0x0000000074580000-0x0000000074D30000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/4500-2-0x0000000005170000-0x0000000005180000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4500-3-0x0000000005730000-0x0000000005CD4000-memory.dmp

            Filesize

            5.6MB

            Download

          • memory/4500-18-0x0000000074580000-0x0000000074D30000-memory.dmp

            Filesize

            7.7MB

            Download