Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07/11/2024, 03:03
Static task
static1
General
-
Target
file.exe
-
Size
3.1MB
-
MD5
d1c392cd0570cdfd8cc42a3d5dfcb0ff
-
SHA1
c993560a4ed0eeaa57fcd97b3f8e411803460cc7
-
SHA256
1baa1cbce4187a8e9f1d71ed8ff9b400690cd11911817ccebc77edad64acad63
-
SHA512
2a9ab0ddd79039c072e4b6655e18d5b96e18b7e4cc098c68877f010d8f12d4793c391f0f044b434f29d8c291a5593e8125a1b65af01d39761cee2c1f3134f8fc
-
SSDEEP
49152:83yYgV4g4c1Qcl0RVQ0lT7GrwaUQaE7sbajATPPSGfX/nF9uG:8o4qwVQ0lTKGQaEgbDTPtX/Fn
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
remcos
DPDNOW
dpdnow.duckdns.org:8452
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-A34JIZ
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Extracted
stealc
tale
http://185.215.113.206
-
url_path
/6c4adf523b719729.php
Extracted
lumma
https://founpiuer.store/api
Signatures
-
Amadey family
-
Lumma family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 8c6e7b3e6c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 8c6e7b3e6c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 8c6e7b3e6c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 8c6e7b3e6c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 8c6e7b3e6c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 8c6e7b3e6c.exe -
Remcos family
-
Stealc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ file.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ remcos_a.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ remcos.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 796a992956.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 9b085a4dd9.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 8c6e7b3e6c.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 14 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 796a992956.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 9b085a4dd9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 8c6e7b3e6c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion remcos.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 796a992956.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 9b085a4dd9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion remcos_a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion remcos.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 8c6e7b3e6c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion remcos_a.exe -
Executes dropped EXE 7 IoCs
pid Process 2676 skotes.exe 376 remcos_a.exe 2256 remcos.exe 2600 buildd.exe 2664 796a992956.exe 1212 9b085a4dd9.exe 616 8c6e7b3e6c.exe -
Identifies Wine through registry keys 2 TTPs 7 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Wine file.exe Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Wine remcos_a.exe Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Wine remcos.exe Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Wine 796a992956.exe Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Wine 9b085a4dd9.exe Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Wine 8c6e7b3e6c.exe -
Loads dropped DLL 12 IoCs
pid Process 3044 file.exe 2676 skotes.exe 2676 skotes.exe 376 remcos_a.exe 376 remcos_a.exe 2676 skotes.exe 2676 skotes.exe 2676 skotes.exe 2676 skotes.exe 2676 skotes.exe 2676 skotes.exe 2676 skotes.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 8c6e7b3e6c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 8c6e7b3e6c.exe -
Accesses Microsoft Outlook profiles 1 TTPs 9 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 buildd.exe Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 buildd.exe Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 buildd.exe Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 buildd.exe Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 buildd.exe Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 buildd.exe Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 buildd.exe Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 buildd.exe Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 buildd.exe -
Adds Run key to start application 2 TTPs 7 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\8c6e7b3e6c.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1004514001\\8c6e7b3e6c.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-A34JIZ = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" remcos_a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-A34JIZ = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" remcos_a.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-A34JIZ = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" remcos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-A34JIZ = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" remcos.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\796a992956.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1004511001\\796a992956.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\9b085a4dd9.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1004512001\\9b085a4dd9.exe" skotes.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 8 ip-api.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
pid Process 3044 file.exe 2676 skotes.exe 376 remcos_a.exe 2256 remcos.exe 2664 796a992956.exe 1212 9b085a4dd9.exe 616 8c6e7b3e6c.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job file.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c6e7b3e6c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language remcos_a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language remcos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 796a992956.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9b085a4dd9.exe -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 1800 cmd.exe 2932 netsh.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2644 timeout.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3044 file.exe 2676 skotes.exe 376 remcos_a.exe 2256 remcos.exe 2600 buildd.exe 2600 buildd.exe 2600 buildd.exe 2600 buildd.exe 2600 buildd.exe 2664 796a992956.exe 1212 9b085a4dd9.exe 616 8c6e7b3e6c.exe 616 8c6e7b3e6c.exe 616 8c6e7b3e6c.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
description pid Process Token: SeDebugPrivilege 2600 buildd.exe Token: SeAssignPrimaryTokenPrivilege 2600 buildd.exe Token: SeIncreaseQuotaPrivilege 2600 buildd.exe Token: SeSecurityPrivilege 2600 buildd.exe Token: SeTakeOwnershipPrivilege 2600 buildd.exe Token: SeLoadDriverPrivilege 2600 buildd.exe Token: SeSystemtimePrivilege 2600 buildd.exe Token: SeBackupPrivilege 2600 buildd.exe Token: SeRestorePrivilege 2600 buildd.exe Token: SeShutdownPrivilege 2600 buildd.exe Token: SeSystemEnvironmentPrivilege 2600 buildd.exe Token: SeUndockPrivilege 2600 buildd.exe Token: SeManageVolumePrivilege 2600 buildd.exe Token: SeDebugPrivilege 616 8c6e7b3e6c.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3044 file.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2256 remcos.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3044 wrote to memory of 2676 3044 file.exe 30 PID 3044 wrote to memory of 2676 3044 file.exe 30 PID 3044 wrote to memory of 2676 3044 file.exe 30 PID 3044 wrote to memory of 2676 3044 file.exe 30 PID 2676 wrote to memory of 376 2676 skotes.exe 32 PID 2676 wrote to memory of 376 2676 skotes.exe 32 PID 2676 wrote to memory of 376 2676 skotes.exe 32 PID 2676 wrote to memory of 376 2676 skotes.exe 32 PID 376 wrote to memory of 2256 376 remcos_a.exe 33 PID 376 wrote to memory of 2256 376 remcos_a.exe 33 PID 376 wrote to memory of 2256 376 remcos_a.exe 33 PID 376 wrote to memory of 2256 376 remcos_a.exe 33 PID 2676 wrote to memory of 2600 2676 skotes.exe 34 PID 2676 wrote to memory of 2600 2676 skotes.exe 34 PID 2676 wrote to memory of 2600 2676 skotes.exe 34 PID 2676 wrote to memory of 2600 2676 skotes.exe 34 PID 2600 wrote to memory of 1800 2600 buildd.exe 35 PID 2600 wrote to memory of 1800 2600 buildd.exe 35 PID 2600 wrote to memory of 1800 2600 buildd.exe 35 PID 1800 wrote to memory of 2832 1800 cmd.exe 37 PID 1800 wrote to memory of 2832 1800 cmd.exe 37 PID 1800 wrote to memory of 2832 1800 cmd.exe 37 PID 1800 wrote to memory of 2932 1800 cmd.exe 38 PID 1800 wrote to memory of 2932 1800 cmd.exe 38 PID 1800 wrote to memory of 2932 1800 cmd.exe 38 PID 1800 wrote to memory of 1920 1800 cmd.exe 39 PID 1800 wrote to memory of 1920 1800 cmd.exe 39 PID 1800 wrote to memory of 1920 1800 cmd.exe 39 PID 2600 wrote to memory of 1700 2600 buildd.exe 40 PID 2600 wrote to memory of 1700 2600 buildd.exe 40 PID 2600 wrote to memory of 1700 2600 buildd.exe 40 PID 1700 wrote to memory of 3024 1700 cmd.exe 42 PID 1700 wrote to memory of 3024 1700 cmd.exe 42 PID 1700 wrote to memory of 3024 1700 cmd.exe 42 PID 1700 wrote to memory of 996 1700 cmd.exe 43 PID 1700 wrote to memory of 996 1700 cmd.exe 43 PID 1700 wrote to memory of 996 1700 cmd.exe 43 PID 1700 wrote to memory of 1416 1700 cmd.exe 44 PID 1700 wrote to memory of 1416 1700 cmd.exe 44 PID 1700 wrote to memory of 1416 1700 cmd.exe 44 PID 2600 wrote to memory of 2408 2600 buildd.exe 46 PID 2600 wrote to memory of 2408 2600 buildd.exe 46 PID 2600 wrote to memory of 2408 2600 buildd.exe 46 PID 2408 wrote to memory of 2684 2408 cmd.exe 48 PID 2408 wrote to memory of 2684 2408 cmd.exe 48 PID 2408 wrote to memory of 2684 2408 cmd.exe 48 PID 2408 wrote to memory of 2644 2408 cmd.exe 49 PID 2408 wrote to memory of 2644 2408 cmd.exe 49 PID 2408 wrote to memory of 2644 2408 cmd.exe 49 PID 2676 wrote to memory of 2664 2676 skotes.exe 50 PID 2676 wrote to memory of 2664 2676 skotes.exe 50 PID 2676 wrote to memory of 2664 2676 skotes.exe 50 PID 2676 wrote to memory of 2664 2676 skotes.exe 50 PID 2676 wrote to memory of 1212 2676 skotes.exe 51 PID 2676 wrote to memory of 1212 2676 skotes.exe 51 PID 2676 wrote to memory of 1212 2676 skotes.exe 51 PID 2676 wrote to memory of 1212 2676 skotes.exe 51 PID 2676 wrote to memory of 1920 2676 skotes.exe 52 PID 2676 wrote to memory of 1920 2676 skotes.exe 52 PID 2676 wrote to memory of 1920 2676 skotes.exe 52 PID 2676 wrote to memory of 1920 2676 skotes.exe 52 PID 2676 wrote to memory of 616 2676 skotes.exe 53 PID 2676 wrote to memory of 616 2676 skotes.exe 53 PID 2676 wrote to memory of 616 2676 skotes.exe 53 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 buildd.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 buildd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\1004494001\remcos_a.exe"C:\Users\Admin\AppData\Local\Temp\1004494001\remcos_a.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:376 -
C:\ProgramData\Remcos\remcos.exe"C:\ProgramData\Remcos\remcos.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2256
-
-
-
C:\Users\Admin\AppData\Local\Temp\1004506001\buildd.exe"C:\Users\Admin\AppData\Local\Temp\1004506001\buildd.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:2600 -
C:\Windows\system32\cmd.exe"cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"4⤵
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\system32\chcp.comchcp 650015⤵PID:2832
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles5⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:2932
-
-
C:\Windows\system32\findstr.exefindstr /R /C:"[ ]:[ ]"5⤵PID:1920
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal"4⤵
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\system32\chcp.comchcp 650015⤵PID:3024
-
-
C:\Windows\system32\netsh.exenetsh wlan show networks mode=bssid5⤵
- Event Triggered Execution: Netsh Helper DLL
PID:996
-
-
C:\Windows\system32\findstr.exefindstr "SSID BSSID Signal"5⤵PID:1416
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C chcp 65001 && timeout /t 3 > NUL && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\1004506001\buildd.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\system32\chcp.comchcp 650015⤵PID:2684
-
-
C:\Windows\system32\timeout.exetimeout /t 35⤵
- Delays execution with timeout.exe
PID:2644
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1004511001\796a992956.exe"C:\Users\Admin\AppData\Local\Temp\1004511001\796a992956.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2664
-
-
C:\Users\Admin\AppData\Local\Temp\1004512001\9b085a4dd9.exe"C:\Users\Admin\AppData\Local\Temp\1004512001\9b085a4dd9.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1212
-
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"3⤵PID:1920
-
-
C:\Users\Admin\AppData\Local\Temp\1004514001\8c6e7b3e6c.exe"C:\Users\Admin\AppData\Local\Temp\1004514001\8c6e7b3e6c.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:616
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Registry
3Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
1Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD58a28539a8df255a7b390574c63a1b020
SHA17555112420d4873ccc23f719e862437e347f607e
SHA25649371a39674d1e34f5dee19772d46285083272822d501b64ab9c26b7706e22b2
SHA512b631a43057086d074b3f03ccde12d9f7aad2f8c5276d820aa1319b46df6521e29a6bfd86b0c5149ab68df467ea8c53e44916faa71766d25e1c74b2e0dfa65676
-
Filesize
1.9MB
MD5b85c47881ba0eb0b556b83827f8e75c8
SHA1dccdf0daee468f9e9bed3edf928f0839d26b47cb
SHA2569d577624acca69f5b4097a6882e934b026a344757cf5cf31f3341e643ed2ba20
SHA512ca158aff36e4eeff5d1c263a79972dfa0aa7584132f12a3d301a5cc5c47b57309fe71b4837c7b8caa5022cb18529b565d6a0849acdabd1af939b76b48284a605
-
Filesize
154KB
MD5c426f46f2c074eda8c903f9868be046d
SHA1d0352482370beff107eb2b2f13e2de275fbc91c7
SHA2567cba781d569196e89a86f10cee7d69918fe05df1461d1f0ed3426ccb2046002e
SHA51297eed1bad31bd2e558d2cf6ff3c3026d828f561e2d1439f0daca420f53a3c6b1d59442f043357be9a33761a8e99ac935d08239d2e50811d47909cec8caad7c05
-
Filesize
3.0MB
MD5a17f03daddf4ffd5b038f13ca94cca7d
SHA1ba20321c4f47082502dadddec7a70769c21e253a
SHA2564149dded7fd91b0eca160fff8d1e48d81bd206ef719bd54d1d5f86bc023eb4f9
SHA5127a4d981c68e5be25078a18ae2844c1842c491f93137b7b3037a3ae2af9dd1074ce37f33bcf79c7bb9e47eb83a3ceb595918171f09039c2d1d398e7d892479a54
-
Filesize
2.1MB
MD5d21a2eb1558c04af68aa39932c381a77
SHA18a1c7f2c06fcf55ccdfb8155a2aa2ec94cb8c5bb
SHA256ba62e9e2f8ace5672fbc814db0b5fbd5a2d0a5d2d8ef55fd359e91ac756b4bbc
SHA512bffa84774f7857c827702c1f21619f55e4fe7b8fab650b1e8598ab5d5c327b9ddf80724a3be0acb605c5e177b330830276c59e999754fc28809f1781feba2fc7
-
Filesize
2.6MB
MD5941e61557ef13f76a606c961a64ed6ab
SHA14e95ec0b08c384f4c9752b21df3a50c1a049d00a
SHA256a9f670416324be30fb1ebf3aceb1d7874624461fd3cd7fb094bf8ec917a9720f
SHA5127f804f2dcbb3f8ae209bdddea61259a5c94648661c29f44a6425cd89fcd4ab93f2550a0f05558dfa6071cfd2ebf9831b42e19d967a76f12fbdda62df68d323c3
-
Filesize
3.1MB
MD5d1c392cd0570cdfd8cc42a3d5dfcb0ff
SHA1c993560a4ed0eeaa57fcd97b3f8e411803460cc7
SHA2561baa1cbce4187a8e9f1d71ed8ff9b400690cd11911817ccebc77edad64acad63
SHA5122a9ab0ddd79039c072e4b6655e18d5b96e18b7e4cc098c68877f010d8f12d4793c391f0f044b434f29d8c291a5593e8125a1b65af01d39761cee2c1f3134f8fc