Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13/11/2024, 08:20
General
-
Target
a754c8899bf9ffc378d8fe239a58b0154bd9fc7cf8b2f2fdc1b1103885a70c99.exe
-
Size
699KB
-
MD5
63d2f97a6de92084873293a617e685db
-
SHA1
423997f0830a1f833d7c1e6b615ac84850b298a1
-
SHA256
a754c8899bf9ffc378d8fe239a58b0154bd9fc7cf8b2f2fdc1b1103885a70c99
-
SHA512
2954eb36e39cbfa18c024dae9536d42b4f2eecf16bf3db623e0efc3f1a7ba02f9df4a1831abb4315b03b83c7497278b10f8001ea484cc31da8352f265f214743
-
SSDEEP
12288:E3cAEjow+kXtp28J4cGUhl+n0kbd6t21Rwm3+9rtQEFoxB50+tNADhZebeEkO/:E3cAEjow+kXf28J4cGeAn0Ttzm3EruEa
Malware Config
Extracted
remcos
ReBorn
gerfourt99lahjou2.duckdns.org:3487
gerfourt99lahjou2.duckdns.org:3488
gerfourt99lahjou3.duckdns.org:3487
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
ksaourts.dat
-
keylog_flag
false
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
ksajoutr-WG0CPT
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
- startup_value
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Remcos family
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a754c8899bf9ffc378d8fe239a58b0154bd9fc7cf8b2f2fdc1b1103885a70c99.exe"C:\Users\Admin\AppData\Local\Temp\a754c8899bf9ffc378d8fe239a58b0154bd9fc7cf8b2f2fdc1b1103885a70c99.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a754c8899bf9ffc378d8fe239a58b0154bd9fc7cf8b2f2fdc1b1103885a70c99.exe"C:\Users\Admin\AppData\Local\Temp\a754c8899bf9ffc378d8fe239a58b0154bd9fc7cf8b2f2fdc1b1103885a70c99.exe"2⤵
- Adds Run key to start application
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD512b140583e3273ee1f65016becea58c4
SHA192df24d11797fefd2e1f8d29be9dfd67c56c1ada
SHA256014f1dfeb842cf7265a3644bc6903c592abe9049bfc7396829172d3d72c4d042
SHA51249ffdfa1941361430b6acb3555fd3aa05e4120f28cbdf7ceaa2af5937d0b8cccd84471cf63f06f97cf203b4aa20f226bdad082e9421b8e6b62ab6e1e9fc1e68a
-
Filesize
37B
MD5b05c56da40014d9bf153f424fdc4c383
SHA13cecd157970f2e84cf8e44b3cfd686a8ffb18c1b
SHA25644a6f71fe08d49b304938e2b0cc881510b4cb7cabcf8760e252db9bb94ce1752
SHA5128b2e053d9465a03fc26d4bc3636c33d028fcd3edb1fa842eb8294971df33d5a16234560509289a010aa7dd2740ff00a25a79826cde58bf95f85e0d5482a16cf5
-
Filesize
48B
MD5aa0117e85825cf1ba0c745d77ace0508
SHA15c50f3315b18b00308ebbcd881870f303004cd78
SHA2567b272f0053bbcdedb4fa3ae5d50801a53df8c19872759361ba5de9f65294cc62
SHA512c6ff6089964b8171aa0780ddae6ce75343ceed25bb7ba737f5cf95b4ce1911ecdb2bd61389f18d2a53739209b9a46d93e2dc89eb3a7b0485d848f16f15550847
-
Filesize
49B
MD5bd5ded41ccbf85dc8cd6d8e986d2b44c
SHA11e613dba3b771ae829b07fc7ab41d6bc9e3265dc
SHA256a5bc3678762ed9a8cecf2330608a6402fb35c2294e1c6d1b3fd770be6231c55b
SHA512e20cac6f457eaaee4ced97a1b3dd60f56d7f0dad7dfc0f683e2b025a1431d47e5e8c62eb71218af6a26967171d025c4be350aa8a32c05b1a106ee62d3a97a9e1
-
Filesize
56B
MD5d5f1458e5d902ac7ad80c68d24774d42
SHA167ff9152ddb4dd68d86a15b36106e938466364c5
SHA2567ca2dfdf8dc94f01a7b20ee482d7abc1a60c33b1787fe3c7e431dfb6f6717a01
SHA5124532f426a42030df2a4cd3c9e61411b7a24918e1854af3a1b4b4b9d3199cdebebc42f8c7d1336319429c9208fc2235f0844cbf95b0335ac67d180609549f338c
-
Filesize
30B
MD5f15bfdebb2df02d02c8491bde1b4e9bd
SHA193bd46f57c3316c27cad2605ddf81d6c0bde9301
SHA256c87f2ff45bb530577fb8856df1760edaf1060ae4ee2934b17fdd21b7d116f043
SHA5121757ed4ae4d47d0c839511c18be5d75796224d4a3049e2d8853650ace2c5057c42040de6450bf90dd4969862e9ebb420cd8a34f8dd9c970779ed2e5459e8f2f1
-
Filesize
12B
MD5f55b9d6e5f20db4066c68219d6cc7244
SHA1b3a70fc3ea2da60d58274d9466a88a1e57926356
SHA2569c2c033694acd2ee629918b688ee91e0032e6d2fa5cbb6b39a13e50024e73e01
SHA51235bde19664ead683e639f42ed8447eab5bac8a1ac873efde467439e0631e3ece634b90e25140e62f46189df57f5c8fb6af44a8062ca9750514f8571d5860f2e1
-
Filesize
17B
MD5aa56823a4614597aa5035bfb3f63c847
SHA1873c3e649bf0b41d9b4d1ee998df6e47abd32841
SHA2567d544ae2f97f0655acb9017ff329202409d17e86552e93c27c08ae532cb57f98
SHA5120a9c4cac8181cdd5638c9bcd1898370c1b51bef5094eaa886e06937e6e36986f31a54b14a0d044c64ef4b332dc5d785dfdaf5ac5e1c067eb4421fd87f2486472
-
Filesize
25B
MD5d3144a48344fb7e92143afd22844d684
SHA15125040cc4ae70e7d78bc767cba0bca8238e21ac
SHA256094fe155451e834d551457304fa995d544fde9079944bb275f6b4bc158e25e2d
SHA51298b0a5f95b730738f02e04c7ed2906d0a7bdbbfab7ffe34c2317f36ceff0a9fae3068f0a4a17d8829c1e6355984e19c50c399e4b7ae2c81a568adf826fcbcb37
-
Filesize
29B
MD5f302a24fc452fd85d13ad30a272d6f35
SHA13b9153f575b70084ae04fd55d5c86169eaa60916
SHA2562edbbfdef57bac60adc902d6bd15abb9c3e044c0f660c9a63135d37ac0f6c63a
SHA512477c3efa5d2bf5ef6ac57a0dc190014f98ff0bd1181106edff7b0db01d58b7f0d8c6eb77266202249f035cc056a726bfd7abdc2e0d672aadc9a45ed29d4b1bd0
-
Filesize
50B
MD566232700b45a0cd2fca0b0ab4c15cf1d
SHA15b63ae813636c07f4de62f88425d23c3c75e024b
SHA2566a3fde98ef05ef8b76bb66538de3e3e14b6d9928176532293645b0cb27325c9d
SHA512f97a2e4779c99d335f4118b94dfb004c65efe5342c6fc75632bfa6f96ac14c5c35cd1adc11a7e5472dc22553e6151e109e2cca5694139eea6fa32e620c0c5054
-
Filesize
4B
MD5cde63b34c142af0a38cbe83791c964f8
SHA1ece2b194b486118b40ad12c1f0e9425dd0672424
SHA25665e2d70166c9a802b7ad2a87129b8945f083e5f268878790a9d1f1c03f47938d
SHA5120559d3d34ad64ccc27e685431c24fc6ead0f645db14fa0e125a64fb67dbd158c15432c1fc5407811aac8a3486090dfbcfcbc3c6bf5aa0ec73f979ef62d14853c
-
Filesize
60B
MD594d50858f536d0b073217deb807d181a
SHA1deaaf25f8ec263928644fceb69dcb199a06cf8e7
SHA2562e191ac2589e939929565cf8bd27d1caa964a008e0e3601d3aa868232881439d
SHA512f7ff9d549378b002cb9abe8c2cc826d3df1ff15f66bcf06ef0c0c55ecf70560e0c0b7951cefd8c94a7687fd38ca8b6c19668074772f1aac5e8a42bebbd6c2534
-
Filesize
33B
MD59af05971c5b2a8214e75e8a475e8684a
SHA1ce80b905be770b4af3cbaa3d4bf739c472e6a833
SHA25684bd18b38d9afd9df0d0c6271672f1490f4fde3c0729d82fa4e034ac424ace87
SHA5124923967ea8a73a066bd643857b7aef8a40a980a3728ea471437b4b1db251c1fa7bf8ff13b1d22b60c1145dd0147f9704af7d996dd7ca36f5a25748358388a658
-
Filesize
9B
MD52b3884fe02299c565e1c37ee7ef99293
SHA1d8e2ef2a52083f6df210109fea53860ea227af9c
SHA256ae789a65914ed002efb82dad89e5a4d4b9ec8e7faae30d0ed6e3c0d20f7d3858
SHA512aeb9374a52d0ad99336bfd4ec7bb7c5437b827845b8784d9c21f7d96a931693604689f6adc3ca25fad132a0ad6123013211ff550f427fa86e4f26c122ac6a0fe
-
Filesize
34B
MD544faec7c0702b7ef4cda5820a608da0a
SHA110313d20436f6968228a07ad4dfad29f37e6532d
SHA256c9eb8d8cea8dd215bb20f4674c6b4b3ea865cc9390eb982c501af89142dfd95d
SHA512dd2bf84c8609abd2f9acc8f45ead13f65f2f804cc2951774b857c0a86616d2a4656a88af4d8277e71bb3bf34afd065ed4dd62577f215f8e4b2f6683967db3a39
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
4KB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB