Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
08/04/2024, 12:17
General
-
Target
3c9065a948387b76124f035b405d3644ac960b18d8ca7b0437c02d8c98b8b811.exe
-
Size
1.3MB
-
MD5
1d779d40600de25a3e0bcf6953d2716e
-
SHA1
56c59c5f0cf6a074c4d2830b4475c3fd0b1ce2d1
-
SHA256
3c9065a948387b76124f035b405d3644ac960b18d8ca7b0437c02d8c98b8b811
-
SHA512
7bb58f0cc67dba7dd8b33e06f6a775eba649680f104c5d097870bea88b108fa221891339cad1f8c4c1dfaf894380e65dd9d728aacbd4c0c0575ac8af949accff
-
SSDEEP
24576:6qDEvCTbMWu7rQYlBQcBiT6rprG8aJUv3K/nmmUcgy+R+q:6TvC/MTQYxsWR7aJRnzUTzR
Malware Config
Extracted
remcos
RemoteHost
193.222.96.75:8823
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-TNRDZX
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Drops startup file 1 IoCs
-
Executes dropped EXE 1 IoCs
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SendNotifyMessage 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c9065a948387b76124f035b405d3644ac960b18d8ca7b0437c02d8c98b8b811.exe"C:\Users\Admin\AppData\Local\Temp\3c9065a948387b76124f035b405d3644ac960b18d8ca7b0437c02d8c98b8b811.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Archimago\antholite.exe"C:\Users\Admin\AppData\Local\Temp\3c9065a948387b76124f035b405d3644ac960b18d8ca7b0437c02d8c98b8b811.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=2240,i,16875000905773190493,11379096115878622792,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD54512a980db75f3ec2ffce0f67cbc3706
SHA1ae31693339221dc217aff05d7407642b9257de08
SHA2564a65de426959a6d57b3db017c190d8a3c53aef4ff92d74199141d49939c98389
SHA512b4a86b751cb5d1b90a34a18cb0ebbbed864591ea6fec1c1049d5469a5c464c7e2faa7cf4475b979b2ad8330b301b7924299de054c8a449d41a086e496f9a75e6
-
Filesize
106.3MB
MD502d5429f3a650200e86c2d31575ef4f4
SHA195376106938578a148aff2d88c7c37ecae069deb
SHA256e318569663f67661884567de91aed1f650ceae7bfa325958ed7121e338c96357
SHA5124ef3d65f0831c8c683ef0649f362d607872fa9aa769ed28347ce3fe87bd4d6f11a6d0c8e8fe87219f33111dd4ce2fbe9ed7cefebaabf7060daa6d0889744b7b2
-
Filesize
29KB
MD56ab1c336cc31c275489f031d8d48e74b
SHA1fd0a211434df571099c5e6387f446f87b9e71a9d
SHA256ac04026bf644efd9ad1d3c939624d3a0394a22726a730e3c3250d0d10cda5898
SHA512ce19f57c86b62955f7049d8479f43584fecea46bfbd7e554d502dbf89a51b9676376e1678292c1aa4eec1bcb555670f34b34dfa20b63ebb9b80a918cdbc55861
-
Filesize
482KB
MD57116dd94279c33e80b987344d27b53e4
SHA178c3aa04a477f17b2e9c157663ceb99765690986
SHA256b747286ea89931d724a30cbc007400f956a76bedc1b61c4213b97d1fa4dc29e0
SHA51264698773a5961c70e74dfe432a569c756d6c4868080ea95c0dd14f3c90878643626439d6dc411de879fab84dd2ee0a415666143fb1c3b0cb7f9281b161dc5773
-
Filesize
16KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB