Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2024, 20:06
Static task
static1
Behavioral task
behavioral1
Sample
9e5634a01e241113ddc1a5a03265cd3e.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
9e5634a01e241113ddc1a5a03265cd3e.exe
Resource
win10v2004-20240910-en
General
-
Target
9e5634a01e241113ddc1a5a03265cd3e.exe
-
Size
2.4MB
-
MD5
9e5634a01e241113ddc1a5a03265cd3e
-
SHA1
17f3cba192f573754797b1fb6f644889f9abaaca
-
SHA256
a8c0001bf62a178870fe526395703f682143078ad37d9b20e50f230dd9059648
-
SHA512
3cea7ff14f48832b7ca955a5fa2c61115b1f2a5ec9f8df52e32692b07d9d34453fef29ef1d7c62ec666e0f38a4899a89db4a68f615602d267c0103d42fe52156
-
SSDEEP
49152:7lnKF46FKC9PgROSeQ146cDPM2vCVapdoqwicf1/y36sbwAE1JgZIESTcNYPMI3Y:7ld16SwwgZRbaEIo
Malware Config
Extracted
remcos
XIOAMORT
vcvfdjvodsuhvf.con-ip.com:1661
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-ALVZO2
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GifCamVideoEditor = "C:\\Users\\Admin\\Music\\GifCamUpdater\\GifCamOculus.exe" 9e5634a01e241113ddc1a5a03265cd3e.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9e5634a01e241113ddc1a5a03265cd3e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9e5634a01e241113ddc1a5a03265cd3e.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4616 9e5634a01e241113ddc1a5a03265cd3e.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3544 wrote to memory of 4616 3544 9e5634a01e241113ddc1a5a03265cd3e.exe 94 PID 3544 wrote to memory of 4616 3544 9e5634a01e241113ddc1a5a03265cd3e.exe 94 PID 3544 wrote to memory of 4616 3544 9e5634a01e241113ddc1a5a03265cd3e.exe 94 PID 3544 wrote to memory of 4616 3544 9e5634a01e241113ddc1a5a03265cd3e.exe 94 PID 3544 wrote to memory of 4616 3544 9e5634a01e241113ddc1a5a03265cd3e.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e5634a01e241113ddc1a5a03265cd3e.exe"C:\Users\Admin\AppData\Local\Temp\9e5634a01e241113ddc1a5a03265cd3e.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\9e5634a01e241113ddc1a5a03265cd3e.exe"C:\Users\Admin\AppData\Local\Temp\9e5634a01e241113ddc1a5a03265cd3e.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4616
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5520f29b4d7767844144e023f1ad7bcea
SHA10ad4780d59ed60783d7f5bc2994c010e9b00dbb8
SHA256fcba8055067486f2e59b626869cea82959e3ee9801e652cad7fb8507c3ca60fd
SHA512d9a2d84918e75adc73edd53af6d83d8c65111743046b163e837269a2a1234bb9ef35dd73947c4d8675796d2d7562ff2786d29c5b61b85480691289db2a3c8a13