Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21/11/2024, 11:45
Static task
static1
Behavioral task
behavioral1
Sample
NEW ORDER- 4788467.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
NEW ORDER- 4788467.exe
Resource
win10v2004-20241007-en
General
-
Target
NEW ORDER- 4788467.exe
-
Size
908KB
-
MD5
1cb86400147c835af58017f0474c5bcc
-
SHA1
ac285cb623bf292341068dead954cfed9a1f8c81
-
SHA256
c35b10fc350209ec356b48282d85b18d9b9ab5c0167dc88461297906602e3d61
-
SHA512
ce74f39d092b13570f9387e5d43ced748dea9557e8887fc072694a2cf448b2c4cf741db3e76d551ebef3511b906ae1cbe0fe670f8968e51d1441982ec73b9b0c
-
SSDEEP
24576:Nqho7Y33wd4D5N4UmVFruPkMKXbY31qKblvh:y1Hwd4FN4UoFqjKXboTp5
Malware Config
Extracted
remcos
RemoteHost
206.189.218.238:4782
206.189.218.238:2286
206.189.218.238:3363
206.189.218.238:3386
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-NJK093
-
screenshot_crypt
false
-
screenshot_flag
true
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
1
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4720 powershell.exe 4388 powershell.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation remcos.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation NEW ORDER- 4788467.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation NEW ORDER- 4788467.exe -
Executes dropped EXE 3 IoCs
pid Process 4476 remcos.exe 2896 remcos.exe 2200 remcos.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-NJK093 = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" NEW ORDER- 4788467.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-NJK093 = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" NEW ORDER- 4788467.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-NJK093 = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" remcos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-NJK093 = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" remcos.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 5016 set thread context of 4740 5016 NEW ORDER- 4788467.exe 100 PID 4476 set thread context of 2896 4476 remcos.exe 110 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language remcos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NEW ORDER- 4788467.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NEW ORDER- 4788467.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language remcos.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2436 schtasks.exe 1988 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 5016 NEW ORDER- 4788467.exe 5016 NEW ORDER- 4788467.exe 4388 powershell.exe 5016 NEW ORDER- 4788467.exe 4388 powershell.exe 4476 remcos.exe 4476 remcos.exe 4476 remcos.exe 4476 remcos.exe 4720 powershell.exe 4476 remcos.exe 4720 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5016 NEW ORDER- 4788467.exe Token: SeDebugPrivilege 4388 powershell.exe Token: SeDebugPrivilege 4476 remcos.exe Token: SeDebugPrivilege 4720 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2896 remcos.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 5016 wrote to memory of 4388 5016 NEW ORDER- 4788467.exe 96 PID 5016 wrote to memory of 4388 5016 NEW ORDER- 4788467.exe 96 PID 5016 wrote to memory of 4388 5016 NEW ORDER- 4788467.exe 96 PID 5016 wrote to memory of 2436 5016 NEW ORDER- 4788467.exe 98 PID 5016 wrote to memory of 2436 5016 NEW ORDER- 4788467.exe 98 PID 5016 wrote to memory of 2436 5016 NEW ORDER- 4788467.exe 98 PID 5016 wrote to memory of 4740 5016 NEW ORDER- 4788467.exe 100 PID 5016 wrote to memory of 4740 5016 NEW ORDER- 4788467.exe 100 PID 5016 wrote to memory of 4740 5016 NEW ORDER- 4788467.exe 100 PID 5016 wrote to memory of 4740 5016 NEW ORDER- 4788467.exe 100 PID 5016 wrote to memory of 4740 5016 NEW ORDER- 4788467.exe 100 PID 5016 wrote to memory of 4740 5016 NEW ORDER- 4788467.exe 100 PID 5016 wrote to memory of 4740 5016 NEW ORDER- 4788467.exe 100 PID 5016 wrote to memory of 4740 5016 NEW ORDER- 4788467.exe 100 PID 5016 wrote to memory of 4740 5016 NEW ORDER- 4788467.exe 100 PID 5016 wrote to memory of 4740 5016 NEW ORDER- 4788467.exe 100 PID 5016 wrote to memory of 4740 5016 NEW ORDER- 4788467.exe 100 PID 5016 wrote to memory of 4740 5016 NEW ORDER- 4788467.exe 100 PID 4740 wrote to memory of 4476 4740 NEW ORDER- 4788467.exe 101 PID 4740 wrote to memory of 4476 4740 NEW ORDER- 4788467.exe 101 PID 4740 wrote to memory of 4476 4740 NEW ORDER- 4788467.exe 101 PID 4476 wrote to memory of 4720 4476 remcos.exe 105 PID 4476 wrote to memory of 4720 4476 remcos.exe 105 PID 4476 wrote to memory of 4720 4476 remcos.exe 105 PID 4476 wrote to memory of 1988 4476 remcos.exe 106 PID 4476 wrote to memory of 1988 4476 remcos.exe 106 PID 4476 wrote to memory of 1988 4476 remcos.exe 106 PID 4476 wrote to memory of 2200 4476 remcos.exe 109 PID 4476 wrote to memory of 2200 4476 remcos.exe 109 PID 4476 wrote to memory of 2200 4476 remcos.exe 109 PID 4476 wrote to memory of 2896 4476 remcos.exe 110 PID 4476 wrote to memory of 2896 4476 remcos.exe 110 PID 4476 wrote to memory of 2896 4476 remcos.exe 110 PID 4476 wrote to memory of 2896 4476 remcos.exe 110 PID 4476 wrote to memory of 2896 4476 remcos.exe 110 PID 4476 wrote to memory of 2896 4476 remcos.exe 110 PID 4476 wrote to memory of 2896 4476 remcos.exe 110 PID 4476 wrote to memory of 2896 4476 remcos.exe 110 PID 4476 wrote to memory of 2896 4476 remcos.exe 110 PID 4476 wrote to memory of 2896 4476 remcos.exe 110 PID 4476 wrote to memory of 2896 4476 remcos.exe 110 PID 4476 wrote to memory of 2896 4476 remcos.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDER- 4788467.exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDER- 4788467.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\mWrixkEbVc.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4388
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mWrixkEbVc" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF3C6.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2436
-
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDER- 4788467.exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDER- 4788467.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\ProgramData\Remcos\remcos.exe"C:\ProgramData\Remcos\remcos.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\mWrixkEbVc.exe"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4720
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mWrixkEbVc" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6387.tmp"4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1988
-
-
C:\ProgramData\Remcos\remcos.exe"C:\ProgramData\Remcos\remcos.exe"4⤵
- Executes dropped EXE
PID:2200
-
-
C:\ProgramData\Remcos\remcos.exe"C:\ProgramData\Remcos\remcos.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2896
-
-
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD596a3d057fff003be449a5881826e9a90
SHA1ebe5b4bac870131a08eb071cacb9091349412469
SHA256d3f66110dd16bb8b125b05d6f4078c578601f4b0c14f02c31ac7a16ee0cacb0b
SHA51255fd31002dcbc05682336ce02e909629139b2d4bec4491567876c04313aa548482b1a0b4c1ae81cf04c489dcb792af34ce21ef9c3dfccdade54a12736a9007cb
-
Filesize
908KB
MD51cb86400147c835af58017f0474c5bcc
SHA1ac285cb623bf292341068dead954cfed9a1f8c81
SHA256c35b10fc350209ec356b48282d85b18d9b9ab5c0167dc88461297906602e3d61
SHA512ce74f39d092b13570f9387e5d43ced748dea9557e8887fc072694a2cf448b2c4cf741db3e76d551ebef3511b906ae1cbe0fe670f8968e51d1441982ec73b9b0c
-
Filesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
Filesize
18KB
MD52d4158ad7012403fb412f6a09bb9ff86
SHA109203c6bf435eeebb129fdac937568b16e97d330
SHA2563ecb4eeb6da1ad60799c29b3cf8420d02c712e0f95af20e7cdd553603bbd8ab0
SHA51259ed22cc0bf2a54e6f5dd15768b47cff5677051b974a5d50161a4d2bb0d7cbc9e44bc38c717febc59f40a8ead5bb764673eb0238493aac35e21889b1556b23ec
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD5fe92aeb8e4ae345b48ea935a7e84cfa6
SHA12c8dfcdb21897688a25343c0b45d3b28d886ed55
SHA256ed26f555f389f0279e13dddd7bf693be6930bbb1de0358c0f26096c6d2ac1b94
SHA512544b613dacdda2658714ec520c62c37bb73d16c2846448ced0374ff9d89c08df6fd33e602091ae4d4c6dd8296d2afe3dca0dd2f1a8875da1d5058a6aa231dac0