Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24/01/2025, 04:03
Static task
static1
Behavioral task
behavioral1
Sample
8a89b09e5ecd985408b3614a1092803957a6154b2925f43ad85fcb5bae6fb137.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8a89b09e5ecd985408b3614a1092803957a6154b2925f43ad85fcb5bae6fb137.exe
Resource
win10v2004-20241007-en
General
-
Target
8a89b09e5ecd985408b3614a1092803957a6154b2925f43ad85fcb5bae6fb137.exe
-
Size
1.1MB
-
MD5
420860ae0fa3744fea3e12d60ec2e5b6
-
SHA1
2cb2862dc0db52f0e061df82a3a6cb64c3e3d22b
-
SHA256
8a89b09e5ecd985408b3614a1092803957a6154b2925f43ad85fcb5bae6fb137
-
SHA512
570545e882e4fc42b76e5ee9886cd5ecd19a1f049436a8617228610d09b89ff321b302d63caedc5676d640e125e53b0d353a85197a755447af8b62626ce20155
-
SSDEEP
24576:1u6J33O0c+JY5UZ+XC0kGso6FakCsU4yYhK3x9uZ3WYd:Xu0c++OCvkGs9Fak4BYd
Malware Config
Extracted
remcos
2.2.0 Pro
RemoteHost
185.217.1.142:3337
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
3
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
true
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-VBI2IL
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" 8a89b09e5ecd985408b3614a1092803957a6154b2925f43ad85fcb5bae6fb137.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" Dxpserver.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" Dxpserver.exe -
Remcos family
-
Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation 8a89b09e5ecd985408b3614a1092803957a6154b2925f43ad85fcb5bae6fb137.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation 8a89b09e5ecd985408b3614a1092803957a6154b2925f43ad85fcb5bae6fb137.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation Dxpserver.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation Dxpserver.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation Dxpserver.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation Dxpserver.exe -
Executes dropped EXE 4 IoCs
pid Process 1908 Dxpserver.exe 4884 Dxpserver.exe 3044 Dxpserver.exe 1552 Dxpserver.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" 8a89b09e5ecd985408b3614a1092803957a6154b2925f43ad85fcb5bae6fb137.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" Dxpserver.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" Dxpserver.exe -
Modifies WinLogon 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ Dxpserver.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ 8a89b09e5ecd985408b3614a1092803957a6154b2925f43ad85fcb5bae6fb137.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ Dxpserver.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x0007000000023c6a-15.dat autoit_exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3672 set thread context of 3796 3672 8a89b09e5ecd985408b3614a1092803957a6154b2925f43ad85fcb5bae6fb137.exe 83 PID 1908 set thread context of 4884 1908 Dxpserver.exe 104 PID 3044 set thread context of 1552 3044 Dxpserver.exe 110 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8a89b09e5ecd985408b3614a1092803957a6154b2925f43ad85fcb5bae6fb137.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8a89b09e5ecd985408b3614a1092803957a6154b2925f43ad85fcb5bae6fb137.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dxpserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dxpserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dxpserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dxpserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings Dxpserver.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings 8a89b09e5ecd985408b3614a1092803957a6154b2925f43ad85fcb5bae6fb137.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings Dxpserver.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4844 schtasks.exe 220 schtasks.exe 4024 schtasks.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 3672 wrote to memory of 3796 3672 8a89b09e5ecd985408b3614a1092803957a6154b2925f43ad85fcb5bae6fb137.exe 83 PID 3672 wrote to memory of 3796 3672 8a89b09e5ecd985408b3614a1092803957a6154b2925f43ad85fcb5bae6fb137.exe 83 PID 3672 wrote to memory of 3796 3672 8a89b09e5ecd985408b3614a1092803957a6154b2925f43ad85fcb5bae6fb137.exe 83 PID 3672 wrote to memory of 3796 3672 8a89b09e5ecd985408b3614a1092803957a6154b2925f43ad85fcb5bae6fb137.exe 83 PID 3672 wrote to memory of 3796 3672 8a89b09e5ecd985408b3614a1092803957a6154b2925f43ad85fcb5bae6fb137.exe 83 PID 3796 wrote to memory of 1596 3796 8a89b09e5ecd985408b3614a1092803957a6154b2925f43ad85fcb5bae6fb137.exe 84 PID 3796 wrote to memory of 1596 3796 8a89b09e5ecd985408b3614a1092803957a6154b2925f43ad85fcb5bae6fb137.exe 84 PID 3796 wrote to memory of 1596 3796 8a89b09e5ecd985408b3614a1092803957a6154b2925f43ad85fcb5bae6fb137.exe 84 PID 3672 wrote to memory of 4844 3672 8a89b09e5ecd985408b3614a1092803957a6154b2925f43ad85fcb5bae6fb137.exe 87 PID 3672 wrote to memory of 4844 3672 8a89b09e5ecd985408b3614a1092803957a6154b2925f43ad85fcb5bae6fb137.exe 87 PID 3672 wrote to memory of 4844 3672 8a89b09e5ecd985408b3614a1092803957a6154b2925f43ad85fcb5bae6fb137.exe 87 PID 1908 wrote to memory of 4884 1908 Dxpserver.exe 104 PID 1908 wrote to memory of 4884 1908 Dxpserver.exe 104 PID 1908 wrote to memory of 4884 1908 Dxpserver.exe 104 PID 1908 wrote to memory of 4884 1908 Dxpserver.exe 104 PID 1908 wrote to memory of 4884 1908 Dxpserver.exe 104 PID 4884 wrote to memory of 1004 4884 Dxpserver.exe 105 PID 4884 wrote to memory of 1004 4884 Dxpserver.exe 105 PID 4884 wrote to memory of 1004 4884 Dxpserver.exe 105 PID 1908 wrote to memory of 220 1908 Dxpserver.exe 107 PID 1908 wrote to memory of 220 1908 Dxpserver.exe 107 PID 1908 wrote to memory of 220 1908 Dxpserver.exe 107 PID 3044 wrote to memory of 1552 3044 Dxpserver.exe 110 PID 3044 wrote to memory of 1552 3044 Dxpserver.exe 110 PID 3044 wrote to memory of 1552 3044 Dxpserver.exe 110 PID 3044 wrote to memory of 1552 3044 Dxpserver.exe 110 PID 3044 wrote to memory of 1552 3044 Dxpserver.exe 110 PID 1552 wrote to memory of 4732 1552 Dxpserver.exe 111 PID 1552 wrote to memory of 4732 1552 Dxpserver.exe 111 PID 1552 wrote to memory of 4732 1552 Dxpserver.exe 111 PID 3044 wrote to memory of 4024 3044 Dxpserver.exe 113 PID 3044 wrote to memory of 4024 3044 Dxpserver.exe 113 PID 3044 wrote to memory of 4024 3044 Dxpserver.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a89b09e5ecd985408b3614a1092803957a6154b2925f43ad85fcb5bae6fb137.exe"C:\Users\Admin\AppData\Local\Temp\8a89b09e5ecd985408b3614a1092803957a6154b2925f43ad85fcb5bae6fb137.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\8a89b09e5ecd985408b3614a1092803957a6154b2925f43ad85fcb5bae6fb137.exe"C:\Users\Admin\AppData\Local\Temp\8a89b09e5ecd985408b3614a1092803957a6154b2925f43ad85fcb5bae6fb137.exe"2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- System Location Discovery: System Language Discovery
PID:1596
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn cttunesvr /tr "C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe" /sc minute /mo 1 /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4844
-
-
C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exeC:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe"C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe"2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- System Location Discovery: System Language Discovery
PID:1004
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn cttunesvr /tr "C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe" /sc minute /mo 1 /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:220
-
-
C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exeC:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe"C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe"2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- System Location Discovery: System Language Discovery
PID:4732
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn cttunesvr /tr "C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe" /sc minute /mo 1 /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4024
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
658B
MD583f285f53e210eaf466f8800e687d1a0
SHA18cc4c6b76665f7f2507ce8e0b1c69868c6ae2b71
SHA256b5b3c11abadc4813f22d41ecdeb41c9cfb45ac82e831c6d208f738a182a20f0f
SHA512606366db0c505cfc56885881f1fae4ade3014b40248a969100b4fffa5b2cd1f0207da9e4ee185eedf5852b1fa6222d1a7157a7c45b8d00787c5064c8fa483650
-
Filesize
564B
MD5e221e7bd7e33aef4a5264f798818142e
SHA13545dbcc35de80c8f15da0daceab80acd0f1ae22
SHA256f37e43a3504c163fa4a82bacc92ceb8cccd37d1020fbba95cc954f316ce49516
SHA51204775d0fa21526bbbaa2deea13af1d5fab6183ea3a2809073539293da78e20f1cf4b9a4afdeafb1b4e8ce17a5be40f44364808ab73c174c98bce53ad8a1807d8
-
Filesize
1.1MB
MD531cfaf3231a0ff4cfd54feb659c80aff
SHA1b0c7b249012e82af4e79f345c4af2f5562e5205f
SHA25610a9214dd694a5cbfcf45dade0f32da90224549b5c3b890bae04dfb99998faef
SHA512cb1610ec21875cba3cf3858118498963aa8cebfef98236a7848e1e2c72c58a1fb8e5f6c58bac5f39e5bcb7451729b75554c92763e7635f8e57ec211de88535fa