Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
178s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2024, 14:26
Static task
static1
Behavioral task
behavioral1
Sample
9e5634a01e241113ddc1a5a03265cd3e.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
9e5634a01e241113ddc1a5a03265cd3e.exe
Resource
win10v2004-20240802-en
General
-
Target
9e5634a01e241113ddc1a5a03265cd3e.exe
-
Size
2.4MB
-
MD5
9e5634a01e241113ddc1a5a03265cd3e
-
SHA1
17f3cba192f573754797b1fb6f644889f9abaaca
-
SHA256
a8c0001bf62a178870fe526395703f682143078ad37d9b20e50f230dd9059648
-
SHA512
3cea7ff14f48832b7ca955a5fa2c61115b1f2a5ec9f8df52e32692b07d9d34453fef29ef1d7c62ec666e0f38a4899a89db4a68f615602d267c0103d42fe52156
-
SSDEEP
49152:7lnKF46FKC9PgROSeQ146cDPM2vCVapdoqwicf1/y36sbwAE1JgZIESTcNYPMI3Y:7ld16SwwgZRbaEIo
Malware Config
Extracted
remcos
XIOAMORT
vcvfdjvodsuhvf.con-ip.com:1661
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-ALVZO2
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GifCamVideoEditor = "C:\\Users\\Admin\\Music\\GifCamUpdater\\GifCamOculus.exe" 9e5634a01e241113ddc1a5a03265cd3e.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9e5634a01e241113ddc1a5a03265cd3e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9e5634a01e241113ddc1a5a03265cd3e.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3456 9e5634a01e241113ddc1a5a03265cd3e.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2848 wrote to memory of 3456 2848 9e5634a01e241113ddc1a5a03265cd3e.exe 82 PID 2848 wrote to memory of 3456 2848 9e5634a01e241113ddc1a5a03265cd3e.exe 82 PID 2848 wrote to memory of 3456 2848 9e5634a01e241113ddc1a5a03265cd3e.exe 82 PID 2848 wrote to memory of 3456 2848 9e5634a01e241113ddc1a5a03265cd3e.exe 82 PID 2848 wrote to memory of 3456 2848 9e5634a01e241113ddc1a5a03265cd3e.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e5634a01e241113ddc1a5a03265cd3e.exe"C:\Users\Admin\AppData\Local\Temp\9e5634a01e241113ddc1a5a03265cd3e.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\9e5634a01e241113ddc1a5a03265cd3e.exe"C:\Users\Admin\AppData\Local\Temp\9e5634a01e241113ddc1a5a03265cd3e.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3456
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD541fd861fdc7253fb9476df967fe778aa
SHA10453ce809bd2ddc66191c7e36a81006d9938bf20
SHA2562f7508760890946de59a4869ae81ba39c5d1796c72343e108c30cfd1e1aa72c9
SHA512582363372a7fedf2728a2183985b9fdbb083d8be1c3073862360612958f056a6c7b62d57c3cbc8153fa023361ec907f4f4b2cd0819f5e6c359f19a456b07689b