Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3rmaildxp_v...ll.exe
windows7-x64
7rmaildxp_v...ll.exe
windows10-2004-x64
7$_14326_/$...st.exe
windows7-x64
3$_14326_/$...st.exe
windows10-2004-x64
3$_14326_/B...er.exe
windows7-x64
3$_14326_/B...er.exe
windows10-2004-x64
3$_14326_/H...x.html
windows7-x64
3$_14326_/H...x.html
windows10-2004-x64
1$_14326_/H...d.html
windows7-x64
3$_14326_/H...d.html
windows10-2004-x64
3$_14326_/H...0.html
windows7-x64
3$_14326_/H...0.html
windows10-2004-x64
3$_14326_/H...1.html
windows7-x64
3$_14326_/H...1.html
windows10-2004-x64
3$_14326_/H...0.html
windows7-x64
3$_14326_/H...0.html
windows10-2004-x64
3$_14326_/H...1.html
windows7-x64
3$_14326_/H...1.html
windows10-2004-x64
3$_14326_/H...2.html
windows7-x64
3$_14326_/H...2.html
windows10-2004-x64
1$_14326_/H...3.html
windows7-x64
3$_14326_/H...3.html
windows10-2004-x64
3$_14326_/H...4.html
windows7-x64
3$_14326_/H...4.html
windows10-2004-x64
3$_14326_/H...5.html
windows7-x64
3$_14326_/H...5.html
windows10-2004-x64
3$_14326_/H...2.html
windows7-x64
3$_14326_/H...2.html
windows10-2004-x64
3$_14326_/H...3.html
windows7-x64
3$_14326_/H...3.html
windows10-2004-x64
3$_14326_/H...4.html
windows7-x64
3$_14326_/H...4.html
windows10-2004-x64
3Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
21/08/2024, 12:10
Static task
static1
Behavioral task
behavioral1
Sample
rmaildxp_v1914_eng_full.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
rmaildxp_v1914_eng_full.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$_14326_/$_14326_/uninst.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$_14326_/$_14326_/uninst.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$_14326_/Base64Helper.exe
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
$_14326_/Base64Helper.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$_14326_/Help/Index.html
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
$_14326_/Help/Index.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$_14326_/Help/advanced.html
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
$_14326_/Help/advanced.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
$_14326_/Help/help0.html
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
$_14326_/Help/help0.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
$_14326_/Help/help1.html
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
$_14326_/Help/help1.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
$_14326_/Help/help10.html
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
$_14326_/Help/help10.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
$_14326_/Help/help11.html
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
$_14326_/Help/help11.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
$_14326_/Help/help12.html
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
$_14326_/Help/help12.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
$_14326_/Help/help13.html
Resource
win7-20240705-en
Behavioral task
behavioral22
Sample
$_14326_/Help/help13.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
$_14326_/Help/help14.html
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
$_14326_/Help/help14.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
$_14326_/Help/help15.html
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
$_14326_/Help/help15.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
$_14326_/Help/help2.html
Resource
win7-20240729-en
Behavioral task
behavioral28
Sample
$_14326_/Help/help2.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
$_14326_/Help/help3.html
Resource
win7-20240705-en
Behavioral task
behavioral30
Sample
$_14326_/Help/help3.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
$_14326_/Help/help4.html
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
$_14326_/Help/help4.html
Resource
win10v2004-20240802-en
General
-
Target
rmaildxp_v1914_eng_full.exe
-
Size
11.6MB
-
MD5
f35abfbb5b669ec5c81cb081271d0902
-
SHA1
92ba34d14835dbbe7a6e9a21e231f0ee0c6a323a
-
SHA256
07f7044c0e0cbd5ba2ce6eaad44e57022068c10dabcec402164fb04041e452f9
-
SHA512
1b251105fb5f5590d44ffd02b787b0529a06575a2d7de666330ac2d56ad855c64415caaeae09906bd088e8301ab6317d6e3449d3018c34a4929511aad45ac282
-
SSDEEP
196608:p1k8hzr6kvCB0nyivptNiHTUvP82reUe0kbC83rMAefIVvSnZN:pjhzr6kJyivptNizUHrX38UN
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 2344 rmaildxp_v1914_eng_full.exe 2344 rmaildxp_v1914_eng_full.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rmaildxp_v1914_eng_full.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2344 rmaildxp_v1914_eng_full.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
707B
MD5372b48b574dcfa916d3f0a233a548842
SHA1dead37187ce5b11931f71ca3a1950403affde032
SHA256a3717942e843af2a6e09ed89da2167475931b974f010e0bc3fdb9f240ce35a76
SHA5122a650aecbc70762227238520aefd0a7b53fd21d30c373172ba1840397222d10e9bc6ac57e0e34831b7fe91327e0c558c75c496c53330395973439107751cfe5a
-
Filesize
13KB
MD5550a3317798d599add2698ec87180919
SHA14c311c88b428972e70645476e59269641365c1bc
SHA2561bee687f883a12d2b475071c244bc0dbc70336e818b28ae65a526332dabf2d1e
SHA512329283aa3397d171efec6fbe1cf15a3b64dbedd66679fa44184d45225b7d3e7845eb85d4340a6b703005e2b7be61a9db2dad160fe130822d4a5d66ef31d63808
-
Filesize
5KB
MD52c3c8976d729d28478a789217a882291
SHA110c18b23fac957419547ef0f8ec3bc1b10e91e79
SHA256799f91bdd59f2133bf195c5b4ca685ee91666d981a6bcd8a6c45b7c8ecc96eef
SHA512749c650974f94cc5009124d3fa3d9bb1ee5824a3fa0a76b81733e08379678a2a1b7c54b77d1709fb6de24c81c68c03c0ec3e9ec5ccad0d30d9237300794f1213