Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14/11/2024, 03:03
Static task
static1
Behavioral task
behavioral1
Sample
bdf1839d82ed286b49c40e5bae59374d59bcbb37ec28266b6aaca47e391ac747.exe
Resource
win7-20240903-en
General
-
Target
bdf1839d82ed286b49c40e5bae59374d59bcbb37ec28266b6aaca47e391ac747.exe
-
Size
1.1MB
-
MD5
e244fd43d06ea0f234c71fff8e3f711f
-
SHA1
a913b51d74327b5fdafa2818acdf72636c3ca20a
-
SHA256
bdf1839d82ed286b49c40e5bae59374d59bcbb37ec28266b6aaca47e391ac747
-
SHA512
6af4afb9dbee48c7d6839d445d25abf3816ead782b0514f7e882a2a1d4e4b732b69bd953ef7b88574a3534d331bc0ce06e88d56ebde2988c8e2702cef2fcf823
-
SSDEEP
24576:uRmJkcoQricOIQxiZY1iaCV/uvPPJUTxDZS4NO7j4MUuvWu:7JZoQrbTFZY1iaCV/uPJoxk4NOIS
Malware Config
Extracted
remcos
NOV 12
leehoi01.ddns.net:9373
103.187.117.76:5584
154.216.18.171:5584
154.216.20.223:5584
leehoi02.ddns.net:9373
areabill.duckdns.org:9373
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-KA6I08
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\outvaunts.vbs outvaunts.exe -
Executes dropped EXE 1 IoCs
pid Process 1632 outvaunts.exe -
Loads dropped DLL 1 IoCs
pid Process 2224 bdf1839d82ed286b49c40e5bae59374d59bcbb37ec28266b6aaca47e391ac747.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x000f000000018683-13.dat autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1632 set thread context of 2872 1632 outvaunts.exe 31 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdf1839d82ed286b49c40e5bae59374d59bcbb37ec28266b6aaca47e391ac747.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1632 outvaunts.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2872 svchost.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2224 wrote to memory of 1632 2224 bdf1839d82ed286b49c40e5bae59374d59bcbb37ec28266b6aaca47e391ac747.exe 30 PID 2224 wrote to memory of 1632 2224 bdf1839d82ed286b49c40e5bae59374d59bcbb37ec28266b6aaca47e391ac747.exe 30 PID 2224 wrote to memory of 1632 2224 bdf1839d82ed286b49c40e5bae59374d59bcbb37ec28266b6aaca47e391ac747.exe 30 PID 2224 wrote to memory of 1632 2224 bdf1839d82ed286b49c40e5bae59374d59bcbb37ec28266b6aaca47e391ac747.exe 30 PID 1632 wrote to memory of 2872 1632 outvaunts.exe 31 PID 1632 wrote to memory of 2872 1632 outvaunts.exe 31 PID 1632 wrote to memory of 2872 1632 outvaunts.exe 31 PID 1632 wrote to memory of 2872 1632 outvaunts.exe 31 PID 1632 wrote to memory of 2872 1632 outvaunts.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\bdf1839d82ed286b49c40e5bae59374d59bcbb37ec28266b6aaca47e391ac747.exe"C:\Users\Admin\AppData\Local\Temp\bdf1839d82ed286b49c40e5bae59374d59bcbb37ec28266b6aaca47e391ac747.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\reaffect\outvaunts.exe"C:\Users\Admin\AppData\Local\Temp\bdf1839d82ed286b49c40e5bae59374d59bcbb37ec28266b6aaca47e391ac747.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\bdf1839d82ed286b49c40e5bae59374d59bcbb37ec28266b6aaca47e391ac747.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2872
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5faeaa8082eabcc7f59dd5741165261ff
SHA1da06a47c504cd186c34004a9b82b8652d83f4aa6
SHA2568f6495f21124136054438d8d5c6c9e9f23f96297cf583e8342cec6d37eaee78d
SHA512644f81da30fadf6e064cb307af202960da5e8c02abad81a016f3ff2ec8a42342f3bf56de41823e737799243fab62014ef11daaa2b5ccfe2a859ff2c78f46bc14
-
Filesize
469KB
MD530900a1deec30509b4a27be3b422e1b3
SHA1e15d5e96d970ab38a853954ddef3248782755586
SHA25635447f2a393f57c176ef487fc219208bc5df8065ed7720f3d378ad1d7e679a2e
SHA51279b32a1611c78d639d3ef0fef09d8e1c33051ce05a7d22653be446d36ac291e26892c65fa6f0e7237928ea57a5b1e571a60afe9230498bc5a4961889f886e50d
-
Filesize
168KB
MD50aba2400129da5292eb797d53eb72dc0
SHA1c60074617f55450ef74cbfdeef45c4b45736d56a
SHA25676cf1f1379ae03b203c5446c05a82cc0cfd1dedc27f1f8acac582d047183f278
SHA51293701f4b62127938d885393823caa0f420c1537f35c65ecee3fa3d2960c20fdd2e1274e6efd4ba46e58282b3b895543672fd92f8c5f67c44cf2ba56338d41634
-
Filesize
1.1MB
MD5e244fd43d06ea0f234c71fff8e3f711f
SHA1a913b51d74327b5fdafa2818acdf72636c3ca20a
SHA256bdf1839d82ed286b49c40e5bae59374d59bcbb37ec28266b6aaca47e391ac747
SHA5126af4afb9dbee48c7d6839d445d25abf3816ead782b0514f7e882a2a1d4e4b732b69bd953ef7b88574a3534d331bc0ce06e88d56ebde2988c8e2702cef2fcf823