Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
31/08/2024, 01:46
Static task
static1
Behavioral task
behavioral1
Sample
ab4df763c5581670d4163462003abad97e8a309fa976fb0d840f44bdd17db7ba.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
ab4df763c5581670d4163462003abad97e8a309fa976fb0d840f44bdd17db7ba.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
General
-
Target
ab4df763c5581670d4163462003abad97e8a309fa976fb0d840f44bdd17db7ba.exe
-
Size
782KB
-
MD5
4198250ab9b371a88707e6f5885ad17b
-
SHA1
19204d4586ff59e83ccc974ddf5471690e47eaf1
-
SHA256
ab4df763c5581670d4163462003abad97e8a309fa976fb0d840f44bdd17db7ba
-
SHA512
737e445ea137224269e37e61b776f76db7704333c7f73c4bf7769521f3ca8563ebb30983111ae67eee4c9871b3a688cc9d7a3cfab370f59ebb84b18156408fb8
-
SSDEEP
12288:4GQBy+G5GCSd1eesm6abgGMwNUVPvHooksN:n5+Eq1yHwkvBN
Malware Config
Extracted
remcos
benchao
tochisglobal.ddns.net:6426
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-9R4HLX
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL 11 IoCs
pid Process 3400 ab4df763c5581670d4163462003abad97e8a309fa976fb0d840f44bdd17db7ba.exe 3400 ab4df763c5581670d4163462003abad97e8a309fa976fb0d840f44bdd17db7ba.exe 3400 ab4df763c5581670d4163462003abad97e8a309fa976fb0d840f44bdd17db7ba.exe 3400 ab4df763c5581670d4163462003abad97e8a309fa976fb0d840f44bdd17db7ba.exe 3400 ab4df763c5581670d4163462003abad97e8a309fa976fb0d840f44bdd17db7ba.exe 3400 ab4df763c5581670d4163462003abad97e8a309fa976fb0d840f44bdd17db7ba.exe 3400 ab4df763c5581670d4163462003abad97e8a309fa976fb0d840f44bdd17db7ba.exe 3400 ab4df763c5581670d4163462003abad97e8a309fa976fb0d840f44bdd17db7ba.exe 3400 ab4df763c5581670d4163462003abad97e8a309fa976fb0d840f44bdd17db7ba.exe 3400 ab4df763c5581670d4163462003abad97e8a309fa976fb0d840f44bdd17db7ba.exe 3400 ab4df763c5581670d4163462003abad97e8a309fa976fb0d840f44bdd17db7ba.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\spankingerne\Vidnesbyrd.Syn106 ab4df763c5581670d4163462003abad97e8a309fa976fb0d840f44bdd17db7ba.exe File created C:\Windows\SysWOW64\Dogmefastes.lnk ab4df763c5581670d4163462003abad97e8a309fa976fb0d840f44bdd17db7ba.exe File opened for modification C:\Windows\SysWOW64\Dogmefastes.lnk ab4df763c5581670d4163462003abad97e8a309fa976fb0d840f44bdd17db7ba.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 3064 wab.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 3400 ab4df763c5581670d4163462003abad97e8a309fa976fb0d840f44bdd17db7ba.exe 3064 wab.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3400 set thread context of 3064 3400 ab4df763c5581670d4163462003abad97e8a309fa976fb0d840f44bdd17db7ba.exe 93 -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\eudaemons.ini ab4df763c5581670d4163462003abad97e8a309fa976fb0d840f44bdd17db7ba.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\resources\0409\Opkomlinge\undersluice.yed ab4df763c5581670d4163462003abad97e8a309fa976fb0d840f44bdd17db7ba.exe File opened for modification C:\Windows\resources\lizis\seadromes.ett ab4df763c5581670d4163462003abad97e8a309fa976fb0d840f44bdd17db7ba.exe File opened for modification C:\Windows\resources\sygelejet\devested.per ab4df763c5581670d4163462003abad97e8a309fa976fb0d840f44bdd17db7ba.exe File opened for modification C:\Windows\totlafholdenhedens\Sagittaries.ini ab4df763c5581670d4163462003abad97e8a309fa976fb0d840f44bdd17db7ba.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ab4df763c5581670d4163462003abad97e8a309fa976fb0d840f44bdd17db7ba.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wab.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3400 ab4df763c5581670d4163462003abad97e8a309fa976fb0d840f44bdd17db7ba.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3064 wab.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3400 wrote to memory of 3064 3400 ab4df763c5581670d4163462003abad97e8a309fa976fb0d840f44bdd17db7ba.exe 93 PID 3400 wrote to memory of 3064 3400 ab4df763c5581670d4163462003abad97e8a309fa976fb0d840f44bdd17db7ba.exe 93 PID 3400 wrote to memory of 3064 3400 ab4df763c5581670d4163462003abad97e8a309fa976fb0d840f44bdd17db7ba.exe 93 PID 3400 wrote to memory of 3064 3400 ab4df763c5581670d4163462003abad97e8a309fa976fb0d840f44bdd17db7ba.exe 93 PID 3400 wrote to memory of 3064 3400 ab4df763c5581670d4163462003abad97e8a309fa976fb0d840f44bdd17db7ba.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab4df763c5581670d4163462003abad97e8a309fa976fb0d840f44bdd17db7ba.exe"C:\Users\Admin\AppData\Local\Temp\ab4df763c5581670d4163462003abad97e8a309fa976fb0d840f44bdd17db7ba.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Program Files (x86)\windows mail\wab.exe"C:\Users\Admin\AppData\Local\Temp\ab4df763c5581670d4163462003abad97e8a309fa976fb0d840f44bdd17db7ba.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3064
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD58df6859c07e3fdf35c837a97710f1ba3
SHA1320376a65b9ac27271ad64f921f84e889c71e80e
SHA256004d75831540ed9cddddd23336a2d0e5077176b95825bc800bad028247cae579
SHA512c0df0ff1f601c3a5fe940d30bbedc1fbe0504da16111a88d4efbc4b6d3a72274cef292f8b8e370f51de754034de09f0545b31acce6bf831dba7c9cf6b4949bd4
-
Filesize
5KB
MD5f1e9eed02db3a822a7ddef0c724e5f1f
SHA165864992f5b6c79c5efbefb5b1354648a8a86709
SHA2566dff504c6759c418c6635c9b25b8c91d0d9ef7787a3a93610d7670bb563c09df
SHA512c22b64fff76b25cf53231b8636f07b361d95791c4646787ce7beac27ad6a0de88337dcceb25b5196f97c452dda72e2614647f51a8a18cb4d5228a82ed2e0780c
-
Filesize
11KB
MD517ed1c86bd67e78ade4712be48a7d2bd
SHA11cc9fe86d6d6030b4dae45ecddce5907991c01a0
SHA256bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
SHA5120cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
-
Filesize
982B
MD5f88f4bc881d5809f3b5f7984756ebe4d
SHA1c85d6b5bea15b03bca5efc33d8a8792bfe6a97a2
SHA256a69540c307517828056b0c6e100525be34c89aaf95d1b830fb284a5f56177b75
SHA512605f76dfe62b46c8afa820173e833da6538f9a66cd27ff00186b4ebdbbe6eb712afe6e9fbcc7fdb83bc18184774c11b4bcce35695887a61c4a99dbe53d650ebe
-
Filesize
1KB
MD57b7b2d4c83bb1706ab50356841652f92
SHA1c109fa49a5f2f82cca0c401fdf397d6de760aee2
SHA2569add9134c7f37a36c21eb31b13461bb8e94700fa94b5828e394d17312e002d06
SHA5129837262faea7c421d457c316443892b7ea424ec70e719886145b1db4ab3797277cc9216718b12231025706ee9f9201b679c913a93f7e73d74de1edf958d4afd3