Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
12/12/2024, 05:10
Static task
static1
Behavioral task
behavioral1
Sample
0004532DESCRIPTION.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
0004532DESCRIPTION.exe
Resource
win10v2004-20241007-en
General
-
Target
0004532DESCRIPTION.exe
-
Size
1.3MB
-
MD5
99869676e00d4b9bbafba630976d433d
-
SHA1
382b278b3e0ff8272cac88277e5db6b73ff0b808
-
SHA256
c9c2cc6c696510e2de26e171d083b8f153f8d160eb00bc5cccc6f7f07623e183
-
SHA512
e586c7fb045eaa8e1b2151e6bf2768c2033df3b4d2398d3f27bc601e1864ce438dc5e2c8649dc095ec9aa162a236a9fe1def098e8d7c6443cafcca7a075d58f4
-
SSDEEP
24576:au6J33O0c+JY5UZ+XC0kGso6FaebHHfLOautp30hdL+1aWY:su0c++OCvkGs9FaebnjOauIdOY
Malware Config
Extracted
remcos
RemoteHost
192.3.64.152:2559
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-ZFXG9Y
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\misruling.vbs misruling.exe -
Executes dropped EXE 1 IoCs
pid Process 2836 misruling.exe -
Loads dropped DLL 1 IoCs
pid Process 2828 0004532DESCRIPTION.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x0033000000016d17-8.dat autoit_exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2836 set thread context of 2840 2836 misruling.exe 31 PID 2840 set thread context of 2676 2840 svchost.exe 32 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0004532DESCRIPTION.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language misruling.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2840 svchost.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2836 misruling.exe 2840 svchost.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2828 0004532DESCRIPTION.exe 2828 0004532DESCRIPTION.exe 2836 misruling.exe 2836 misruling.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 2828 0004532DESCRIPTION.exe 2828 0004532DESCRIPTION.exe 2836 misruling.exe 2836 misruling.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2828 wrote to memory of 2836 2828 0004532DESCRIPTION.exe 30 PID 2828 wrote to memory of 2836 2828 0004532DESCRIPTION.exe 30 PID 2828 wrote to memory of 2836 2828 0004532DESCRIPTION.exe 30 PID 2828 wrote to memory of 2836 2828 0004532DESCRIPTION.exe 30 PID 2836 wrote to memory of 2840 2836 misruling.exe 31 PID 2836 wrote to memory of 2840 2836 misruling.exe 31 PID 2836 wrote to memory of 2840 2836 misruling.exe 31 PID 2836 wrote to memory of 2840 2836 misruling.exe 31 PID 2836 wrote to memory of 2840 2836 misruling.exe 31 PID 2840 wrote to memory of 2676 2840 svchost.exe 32 PID 2840 wrote to memory of 2676 2840 svchost.exe 32 PID 2840 wrote to memory of 2676 2840 svchost.exe 32 PID 2840 wrote to memory of 2676 2840 svchost.exe 32 PID 2840 wrote to memory of 2676 2840 svchost.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\0004532DESCRIPTION.exe"C:\Users\Admin\AppData\Local\Temp\0004532DESCRIPTION.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Allene\misruling.exe"C:\Users\Admin\AppData\Local\Temp\0004532DESCRIPTION.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\0004532DESCRIPTION.exe"3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe4⤵PID:2676
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD599869676e00d4b9bbafba630976d433d
SHA1382b278b3e0ff8272cac88277e5db6b73ff0b808
SHA256c9c2cc6c696510e2de26e171d083b8f153f8d160eb00bc5cccc6f7f07623e183
SHA512e586c7fb045eaa8e1b2151e6bf2768c2033df3b4d2398d3f27bc601e1864ce438dc5e2c8649dc095ec9aa162a236a9fe1def098e8d7c6443cafcca7a075d58f4