Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
20/11/2024, 06:36
Static task
static1
Behavioral task
behavioral1
Sample
13ada013639ef3805f361234db589d84426e5dd2045a4b39369fe600c461f4a4.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
13ada013639ef3805f361234db589d84426e5dd2045a4b39369fe600c461f4a4.exe
Resource
win10v2004-20241007-en
General
-
Target
13ada013639ef3805f361234db589d84426e5dd2045a4b39369fe600c461f4a4.exe
-
Size
620KB
-
MD5
0465ec2d24c181b6575a4a8bd1973ec6
-
SHA1
f86c46166593d69dc0cc04fc3991fef8a8673a41
-
SHA256
13ada013639ef3805f361234db589d84426e5dd2045a4b39369fe600c461f4a4
-
SHA512
1ecedc50b7bedbda2f252ef243a980b683b07eed64cd98997ee241c446e705c246e57234d6626598a38cf5b9c27a86fe56399c592cdcd64b936cd080d69f9954
-
SSDEEP
12288:M417/cAhnVxR24T93+suohEX7RGFO3dugtOh0S:M417/ciXRQnoWXEg3dOb
Malware Config
Extracted
remcos
RemoteHost
www.chileeclassproject.com:2404
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
5451
-
mouse_option
false
-
mutex
Rmc-1FU53L
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2984 set thread context of 2916 2984 13ada013639ef3805f361234db589d84426e5dd2045a4b39369fe600c461f4a4.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13ada013639ef3805f361234db589d84426e5dd2045a4b39369fe600c461f4a4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13ada013639ef3805f361234db589d84426e5dd2045a4b39369fe600c461f4a4.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2916 13ada013639ef3805f361234db589d84426e5dd2045a4b39369fe600c461f4a4.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2984 wrote to memory of 2916 2984 13ada013639ef3805f361234db589d84426e5dd2045a4b39369fe600c461f4a4.exe 30 PID 2984 wrote to memory of 2916 2984 13ada013639ef3805f361234db589d84426e5dd2045a4b39369fe600c461f4a4.exe 30 PID 2984 wrote to memory of 2916 2984 13ada013639ef3805f361234db589d84426e5dd2045a4b39369fe600c461f4a4.exe 30 PID 2984 wrote to memory of 2916 2984 13ada013639ef3805f361234db589d84426e5dd2045a4b39369fe600c461f4a4.exe 30 PID 2984 wrote to memory of 2916 2984 13ada013639ef3805f361234db589d84426e5dd2045a4b39369fe600c461f4a4.exe 30 PID 2984 wrote to memory of 2916 2984 13ada013639ef3805f361234db589d84426e5dd2045a4b39369fe600c461f4a4.exe 30 PID 2984 wrote to memory of 2916 2984 13ada013639ef3805f361234db589d84426e5dd2045a4b39369fe600c461f4a4.exe 30 PID 2984 wrote to memory of 2916 2984 13ada013639ef3805f361234db589d84426e5dd2045a4b39369fe600c461f4a4.exe 30 PID 2984 wrote to memory of 2916 2984 13ada013639ef3805f361234db589d84426e5dd2045a4b39369fe600c461f4a4.exe 30 PID 2984 wrote to memory of 2916 2984 13ada013639ef3805f361234db589d84426e5dd2045a4b39369fe600c461f4a4.exe 30 PID 2984 wrote to memory of 2916 2984 13ada013639ef3805f361234db589d84426e5dd2045a4b39369fe600c461f4a4.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\13ada013639ef3805f361234db589d84426e5dd2045a4b39369fe600c461f4a4.exe"C:\Users\Admin\AppData\Local\Temp\13ada013639ef3805f361234db589d84426e5dd2045a4b39369fe600c461f4a4.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\13ada013639ef3805f361234db589d84426e5dd2045a4b39369fe600c461f4a4.exe"C:\Users\Admin\AppData\Local\Temp\13ada013639ef3805f361234db589d84426e5dd2045a4b39369fe600c461f4a4.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2916
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5f1ebc59a3f85656d7e4b90e3b1b86d8b
SHA1f57df48a828bf57631a375f7fb504e458092d162
SHA2568408ac1f424c8a201f37278a24d0315b3310fea75475a16fd2ce66b959e8d24f
SHA51225f12b875cb3d84792abca5059a1635c3043b8797bd7565fc1b9b2ee6028602a64cf4c105770255762ca9bff1b458ed532b89d59a81221c702914babd3d6007a