Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/12/2024, 17:42

General

  • Target

    17334752451c3a43189360a7e5b86f13b5ea7a6044304256a8f4c49ad5d5bd4831e72ee12e792.dat-decoded.exe

  • Size

    469KB

  • MD5

    7f2ebe83b860a8de1f3ce798c79b5935

  • SHA1

    3fbea97a5aa637271311851fd152ee37e813c44f

  • SHA256

    fd125d03b2bc8512a9a5dcc6df9ca5045208442bc047af50b5f0a359103c1ba8

  • SHA512

    38645cfa1e5826f06c21c09ba3a3fd11447abea0e66bd281722e9987ea501848086a87e327f689e1282b8532589c75fab182a6777f286030dd5231627038555c

  • SSDEEP

    12288:umnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSln9:WiLJbpI7I2WhQqZ7l9

Score
10/10

Malware Config

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Remcos family
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\17334752451c3a43189360a7e5b86f13b5ea7a6044304256a8f4c49ad5d5bd4831e72ee12e792.dat-decoded.exe
    "C:\Users\Admin\AppData\Local\Temp\17334752451c3a43189360a7e5b86f13b5ea7a6044304256a8f4c49ad5d5bd4831e72ee12e792.dat-decoded.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:3820

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\remcos\logs.dat

    Filesize

    144B

    MD5

    45b5bd597632220dab6c05e6326d7702

    SHA1

    897771db4aec71c161b4bba4d60437a56051f9d4

    SHA256

    b3409e294ec1a6c63b0bac9be10b5b8a75e89528ad4516fb06772b4bef8b8086

    SHA512

    f9c1951d24e6ecb16b0f68ab5932f52e6c8ca27e73aa783fd3c6332654099e76618135f4166850ee92eaebbcd02751ff0de1ba0d9c2dba329fe2a97270ad4c89