Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18/10/2024, 01:01
Behavioral task
behavioral1
Sample
02b4e1709e79653e9569bf727301f92d4928726ba69d8d764db5841b94d63671.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
02b4e1709e79653e9569bf727301f92d4928726ba69d8d764db5841b94d63671.exe
Resource
win10v2004-20241007-en
General
-
Target
02b4e1709e79653e9569bf727301f92d4928726ba69d8d764db5841b94d63671.exe
-
Size
482KB
-
MD5
13095aaded59fb08db07ecf6bc2387ef
-
SHA1
13466ec6545a05da5d8ea49a8ec6c56c4f9aa648
-
SHA256
02b4e1709e79653e9569bf727301f92d4928726ba69d8d764db5841b94d63671
-
SHA512
fe10e40072e12c68edd3c3fcb9583253a4ee9fd7ec42f2a423829202abedf443c654968acb44919ad8ba3ecafa77c95b7fd2b8b641dd83779960363c0bb11bf0
-
SSDEEP
6144:iTz+c6KHYBhDc1RGJdv//NkUn+N5Bkf/0TELRvIZPjbsAOZZXAXkcr/T4:iTlrYw1RUh3NFn+N5WfIQIjbs/ZXgT4
Malware Config
Extracted
remcos
RemoteHost
liveos.zapto.org:2404
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
tst
-
delete_file
false
-
hide_file
true
-
hide_keylog_file
false
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-Y7B4RN
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Rmc-Y7B4RN = "\"C:\\ProgramData\\tst\\remcos.exe\"" 02b4e1709e79653e9569bf727301f92d4928726ba69d8d764db5841b94d63671.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run remcos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Rmc-Y7B4RN = "\"C:\\ProgramData\\tst\\remcos.exe\"" remcos.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 02b4e1709e79653e9569bf727301f92d4928726ba69d8d764db5841b94d63671.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation 02b4e1709e79653e9569bf727301f92d4928726ba69d8d764db5841b94d63671.exe -
Executes dropped EXE 1 IoCs
pid Process 3796 remcos.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-Y7B4RN = "\"C:\\ProgramData\\tst\\remcos.exe\"" remcos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-Y7B4RN = "\"C:\\ProgramData\\tst\\remcos.exe\"" remcos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-Y7B4RN = "\"C:\\ProgramData\\tst\\remcos.exe\"" 02b4e1709e79653e9569bf727301f92d4928726ba69d8d764db5841b94d63671.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-Y7B4RN = "\"C:\\ProgramData\\tst\\remcos.exe\"" 02b4e1709e79653e9569bf727301f92d4928726ba69d8d764db5841b94d63671.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3796 set thread context of 2524 3796 remcos.exe 88 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 02b4e1709e79653e9569bf727301f92d4928726ba69d8d764db5841b94d63671.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language remcos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 02b4e1709e79653e9569bf727301f92d4928726ba69d8d764db5841b94d63671.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3796 remcos.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4228 wrote to memory of 3796 4228 02b4e1709e79653e9569bf727301f92d4928726ba69d8d764db5841b94d63671.exe 87 PID 4228 wrote to memory of 3796 4228 02b4e1709e79653e9569bf727301f92d4928726ba69d8d764db5841b94d63671.exe 87 PID 4228 wrote to memory of 3796 4228 02b4e1709e79653e9569bf727301f92d4928726ba69d8d764db5841b94d63671.exe 87 PID 3796 wrote to memory of 2524 3796 remcos.exe 88 PID 3796 wrote to memory of 2524 3796 remcos.exe 88 PID 3796 wrote to memory of 2524 3796 remcos.exe 88 PID 3796 wrote to memory of 2524 3796 remcos.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\02b4e1709e79653e9569bf727301f92d4928726ba69d8d764db5841b94d63671.exe"C:\Users\Admin\AppData\Local\Temp\02b4e1709e79653e9569bf727301f92d4928726ba69d8d764db5841b94d63671.exe"1⤵
- Adds policy Run key to start application
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\ProgramData\tst\remcos.exe"C:\ProgramData\tst\remcos.exe"2⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3796 -
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2524
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
482KB
MD513095aaded59fb08db07ecf6bc2387ef
SHA113466ec6545a05da5d8ea49a8ec6c56c4f9aa648
SHA25602b4e1709e79653e9569bf727301f92d4928726ba69d8d764db5841b94d63671
SHA512fe10e40072e12c68edd3c3fcb9583253a4ee9fd7ec42f2a423829202abedf443c654968acb44919ad8ba3ecafa77c95b7fd2b8b641dd83779960363c0bb11bf0