Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

63f66c8c25...6d.exe

windows7-x64

3

63f66c8c25...6d.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/01/2025, 02:27 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    63f66c8c25bd326511fed28aaf214e602c85c2f7793a47cfd5e0f38842a6b86d.exe

  • Size

    481KB

  • MD5

    3b2dfefa045f3257002ad8313e5d9db2

  • SHA1

    48b70b309dc15e419112e09c48c93145b6634019

  • SHA256

    63f66c8c25bd326511fed28aaf214e602c85c2f7793a47cfd5e0f38842a6b86d

  • SHA512

    ada39e1f3cba0c6307062eaeebd1b9ac53d57ee5195ba1c645f3d4b03dc3cb1e24c0c4dfc9a7d4e042981cd5561f9a5a2b55ad3e5df9b4efa74cf7e5eedea58a

  • SSDEEP

    12288:L9PgP3HAMwIGjY4vce6lnBthn5HSRVMf139F5woxr+IwtHwBtFhCsvZD5W+P32:Z43HfwIGYMcn5PJrZw+

Score
3/10
discovery

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\63f66c8c25bd326511fed28aaf214e602c85c2f7793a47cfd5e0f38842a6b86d.exe
    "C:\Users\Admin\AppData\Local\Temp\63f66c8c25bd326511fed28aaf214e602c85c2f7793a47cfd5e0f38842a6b86d.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4260

Network

  • flag-us
    DNS
    municipioalcidiadechicamocha.ddnsgeek.com
    63f66c8c25bd326511fed28aaf214e602c85c2f7793a47cfd5e0f38842a6b86d.exe
    Remote address:
    8.8.8.8:53
    Request
    municipioalcidiadechicamocha.ddnsgeek.com
    IN A
    Response
    municipioalcidiadechicamocha.ddnsgeek.com
    IN A
    179.15.136.6
  • flag-us
    DNS
    13.86.106.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.86.106.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    75.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    75.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    58.55.71.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    58.55.71.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    197.87.175.4.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    197.87.175.4.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    171.39.242.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    171.39.242.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    166.190.18.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    166.190.18.2.in-addr.arpa
    IN PTR
    Response
    166.190.18.2.in-addr.arpa
    IN PTR
    a2-18-190-166deploystaticakamaitechnologiescom
  • flag-us
    DNS
    19.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    19.229.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    municipioalcidiadechicamocha.ddnsgeek.com
    63f66c8c25bd326511fed28aaf214e602c85c2f7793a47cfd5e0f38842a6b86d.exe
    Remote address:
    8.8.8.8:53
    Request
    municipioalcidiadechicamocha.ddnsgeek.com
    IN A
    Response
    municipioalcidiadechicamocha.ddnsgeek.com
    IN A
    179.15.136.6
  • 179.15.136.6:1997
    municipioalcidiadechicamocha.ddnsgeek.com
    63f66c8c25bd326511fed28aaf214e602c85c2f7793a47cfd5e0f38842a6b86d.exe
    260 B
     160 B
     5
    4
  • 179.15.136.6:1997
    municipioalcidiadechicamocha.ddnsgeek.com
    63f66c8c25bd326511fed28aaf214e602c85c2f7793a47cfd5e0f38842a6b86d.exe
    260 B
     160 B
     5
    4
  • 179.15.136.6:1997
    municipioalcidiadechicamocha.ddnsgeek.com
    63f66c8c25bd326511fed28aaf214e602c85c2f7793a47cfd5e0f38842a6b86d.exe
    260 B
     120 B
     5
    3
  • 179.15.136.6:1997
    municipioalcidiadechicamocha.ddnsgeek.com
    63f66c8c25bd326511fed28aaf214e602c85c2f7793a47cfd5e0f38842a6b86d.exe
    260 B
     200 B
     5
    5
  • 179.15.136.6:1997
    municipioalcidiadechicamocha.ddnsgeek.com
    63f66c8c25bd326511fed28aaf214e602c85c2f7793a47cfd5e0f38842a6b86d.exe
    260 B
     160 B
     5
    4
  • 179.15.136.6:1997
    municipioalcidiadechicamocha.ddnsgeek.com
    63f66c8c25bd326511fed28aaf214e602c85c2f7793a47cfd5e0f38842a6b86d.exe
    260 B
     160 B
     5
    4
  • 179.15.136.6:1997
    municipioalcidiadechicamocha.ddnsgeek.com
    63f66c8c25bd326511fed28aaf214e602c85c2f7793a47cfd5e0f38842a6b86d.exe
    260 B
     160 B
     5
    4
  • 179.15.136.6:1997
    municipioalcidiadechicamocha.ddnsgeek.com
    63f66c8c25bd326511fed28aaf214e602c85c2f7793a47cfd5e0f38842a6b86d.exe
    260 B
     160 B
     5
    4
  • 179.15.136.6:1997
    municipioalcidiadechicamocha.ddnsgeek.com
    63f66c8c25bd326511fed28aaf214e602c85c2f7793a47cfd5e0f38842a6b86d.exe
    260 B
     200 B
     5
    5
  • 179.15.136.6:1997
    municipioalcidiadechicamocha.ddnsgeek.com
    63f66c8c25bd326511fed28aaf214e602c85c2f7793a47cfd5e0f38842a6b86d.exe
    260 B
     160 B
     5
    4
  • 179.15.136.6:1997
    municipioalcidiadechicamocha.ddnsgeek.com
    63f66c8c25bd326511fed28aaf214e602c85c2f7793a47cfd5e0f38842a6b86d.exe
    260 B
     200 B
     5
    5
  • 179.15.136.6:1997
    municipioalcidiadechicamocha.ddnsgeek.com
    63f66c8c25bd326511fed28aaf214e602c85c2f7793a47cfd5e0f38842a6b86d.exe
    260 B
     200 B
     5
    5
  • 179.15.136.6:1997
    municipioalcidiadechicamocha.ddnsgeek.com
    63f66c8c25bd326511fed28aaf214e602c85c2f7793a47cfd5e0f38842a6b86d.exe
    260 B
     160 B
     5
    4
  • 179.15.136.6:1997
    municipioalcidiadechicamocha.ddnsgeek.com
    63f66c8c25bd326511fed28aaf214e602c85c2f7793a47cfd5e0f38842a6b86d.exe
    260 B
     160 B
     5
    4
  • 179.15.136.6:1997
    municipioalcidiadechicamocha.ddnsgeek.com
    63f66c8c25bd326511fed28aaf214e602c85c2f7793a47cfd5e0f38842a6b86d.exe
    260 B
     160 B
     5
    4
  • 179.15.136.6:1997
    municipioalcidiadechicamocha.ddnsgeek.com
    63f66c8c25bd326511fed28aaf214e602c85c2f7793a47cfd5e0f38842a6b86d.exe
    260 B
     200 B
     5
    5
  • 179.15.136.6:1997
    municipioalcidiadechicamocha.ddnsgeek.com
    63f66c8c25bd326511fed28aaf214e602c85c2f7793a47cfd5e0f38842a6b86d.exe
    260 B
     80 B
     5
    2
  • 179.15.136.6:1997
    municipioalcidiadechicamocha.ddnsgeek.com
    63f66c8c25bd326511fed28aaf214e602c85c2f7793a47cfd5e0f38842a6b86d.exe
    260 B
     120 B
     5
    3
  • 179.15.136.6:1997
    municipioalcidiadechicamocha.ddnsgeek.com
    63f66c8c25bd326511fed28aaf214e602c85c2f7793a47cfd5e0f38842a6b86d.exe
    104 B
     40 B
     2
    1
  • 8.8.8.8:53
    municipioalcidiadechicamocha.ddnsgeek.com
    dns
    63f66c8c25bd326511fed28aaf214e602c85c2f7793a47cfd5e0f38842a6b86d.exe
    87 B
     103 B
     1
    1

    DNS Request

    municipioalcidiadechicamocha.ddnsgeek.com

    DNS Response

    179.15.136.6

  • 8.8.8.8:53
    13.86.106.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    13.86.106.20.in-addr.arpa

  • 8.8.8.8:53
    75.159.190.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    75.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    58.55.71.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    58.55.71.13.in-addr.arpa

  • 8.8.8.8:53
    197.87.175.4.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    197.87.175.4.in-addr.arpa

  • 8.8.8.8:53
    171.39.242.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    171.39.242.20.in-addr.arpa

  • 8.8.8.8:53
    166.190.18.2.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    166.190.18.2.in-addr.arpa

  • 8.8.8.8:53
    19.229.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    19.229.111.52.in-addr.arpa

  • 8.8.8.8:53
    municipioalcidiadechicamocha.ddnsgeek.com
    dns
    63f66c8c25bd326511fed28aaf214e602c85c2f7793a47cfd5e0f38842a6b86d.exe
    87 B
     103 B
     1
    1

    DNS Request

    municipioalcidiadechicamocha.ddnsgeek.com

    DNS Response

    179.15.136.6

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\remcos\logs.dat
    Filesize

    144B

    MD5

    158cf595ee0638f06be1e0ca44b9405e

    SHA1

    59348993fc0789f88e44925e04ef24feeb165fd1

    SHA256

    e12ebfaa0ac5365b39335a6f92dc7ab470a332763bec26cca19408925bb4ac16

    SHA512

    2a85a06376605023a9e26e694e41bd7da1af46c1a335039b3dca89ca28d445c14cc9cec6c2f9326ab4df7221914030c007a0c470d75080f460a8a41d0b5cf99b

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.