Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2024, 03:06
Static task
static1
Behavioral task
behavioral1
Sample
dec26f7cc646acdff30d90fae8837623c70870ed0cc9020930f95b53b6b730db.exe
Resource
win7-20241023-en
General
-
Target
dec26f7cc646acdff30d90fae8837623c70870ed0cc9020930f95b53b6b730db.exe
-
Size
1.3MB
-
MD5
973306ff45c5b4ee7333db7a5ef7a0f9
-
SHA1
32c7065633f821f72f2c2af4a572414cdd79ea91
-
SHA256
dec26f7cc646acdff30d90fae8837623c70870ed0cc9020930f95b53b6b730db
-
SHA512
2d703af64af2c213de8e92ab0fa77d692f55f15c3e85d4f5aa4eb6fc049b2ab36ef8ac7b25a85c06aef8eb22972e5103fb5533288f9f9cccabbbaadebc892540
-
SSDEEP
24576:ztb20pkaCqT5TBWgNQ7ato13PtKK5QXpdbt86F+LAisTLZ6A:wVg5tQ7at8FFOpXt+LAiY5
Malware Config
Extracted
remcos
WORK
netflixyoutubebrowser.duckdns.org:34043
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-CDDRK8
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\schoollike.vbs schoollike.exe -
Executes dropped EXE 1 IoCs
pid Process 4188 schoollike.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x0008000000023c61-9.dat autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4188 set thread context of 2828 4188 schoollike.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dec26f7cc646acdff30d90fae8837623c70870ed0cc9020930f95b53b6b730db.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schoollike.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4188 schoollike.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 3908 dec26f7cc646acdff30d90fae8837623c70870ed0cc9020930f95b53b6b730db.exe 3908 dec26f7cc646acdff30d90fae8837623c70870ed0cc9020930f95b53b6b730db.exe 4188 schoollike.exe 4188 schoollike.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 3908 dec26f7cc646acdff30d90fae8837623c70870ed0cc9020930f95b53b6b730db.exe 3908 dec26f7cc646acdff30d90fae8837623c70870ed0cc9020930f95b53b6b730db.exe 4188 schoollike.exe 4188 schoollike.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3908 wrote to memory of 4188 3908 dec26f7cc646acdff30d90fae8837623c70870ed0cc9020930f95b53b6b730db.exe 83 PID 3908 wrote to memory of 4188 3908 dec26f7cc646acdff30d90fae8837623c70870ed0cc9020930f95b53b6b730db.exe 83 PID 3908 wrote to memory of 4188 3908 dec26f7cc646acdff30d90fae8837623c70870ed0cc9020930f95b53b6b730db.exe 83 PID 4188 wrote to memory of 2828 4188 schoollike.exe 84 PID 4188 wrote to memory of 2828 4188 schoollike.exe 84 PID 4188 wrote to memory of 2828 4188 schoollike.exe 84 PID 4188 wrote to memory of 2828 4188 schoollike.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\dec26f7cc646acdff30d90fae8837623c70870ed0cc9020930f95b53b6b730db.exe"C:\Users\Admin\AppData\Local\Temp\dec26f7cc646acdff30d90fae8837623c70870ed0cc9020930f95b53b6b730db.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\penstocks\schoollike.exe"C:\Users\Admin\AppData\Local\Temp\dec26f7cc646acdff30d90fae8837623c70870ed0cc9020930f95b53b6b730db.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\dec26f7cc646acdff30d90fae8837623c70870ed0cc9020930f95b53b6b730db.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2828
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
481KB
MD5226f0d51adcb15d946de05b1cd862385
SHA1a5fba80b43f7d4c7b826d74234ec60ada74275d6
SHA2568de96916fd4b14bc3d42a8cb28b1f8759a7f17f512a435d63964cd9ba3dda77d
SHA5129f091913108fbba998d5b1b745c273f4aa09cbc9427119aeb383c87a302ccdb07dbde67f146bd116bc795057c290345cf9f3b590fcf354154af0d4197b132b6e
-
Filesize
1.3MB
MD5973306ff45c5b4ee7333db7a5ef7a0f9
SHA132c7065633f821f72f2c2af4a572414cdd79ea91
SHA256dec26f7cc646acdff30d90fae8837623c70870ed0cc9020930f95b53b6b730db
SHA5122d703af64af2c213de8e92ab0fa77d692f55f15c3e85d4f5aa4eb6fc049b2ab36ef8ac7b25a85c06aef8eb22972e5103fb5533288f9f9cccabbbaadebc892540