Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/01/2025, 22:38
Static task
static1
Behavioral task
behavioral1
Sample
38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe
Resource
win10v2004-20241007-en
General
-
Target
38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe
-
Size
1.1MB
-
MD5
dd09e8863ee6d30492d5cba898538f85
-
SHA1
700f5ce79c5fd236ecb778ab0e14dbc7df22bc55
-
SHA256
38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53
-
SHA512
beff97a572ee4576d3ae1eda5e7692b42a0d679abf8f375a19d0df356fcb6726ba9cdfdb1359dc9a8b67a39553cea279acb29fece86f49cf5f53a3f074e87b28
-
SSDEEP
24576:1u6J33O0c+JY5UZ+XC0kGso6FakCsU4yYhK3x9uZ3WYX:Xu0c++OCvkGs9Fak4BYX
Malware Config
Extracted
remcos
2.2.0 Pro
RemoteHost
185.217.1.142:3337
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
3
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
true
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-VBI2IL
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Modifies WinLogon for persistence 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" 38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" Dxpserver.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" Dxpserver.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" Dxpserver.exe -
Remcos family
-
Checks computer location settings 2 TTPs 7 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation 38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation Dxpserver.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation Dxpserver.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation Dxpserver.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation Dxpserver.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation Dxpserver.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation 38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe -
Executes dropped EXE 6 IoCs
pid Process 2332 Dxpserver.exe 1124 Dxpserver.exe 2492 Dxpserver.exe 2232 Dxpserver.exe 2156 Dxpserver.exe 1928 Dxpserver.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" 38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" Dxpserver.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" Dxpserver.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" Dxpserver.exe -
Modifies WinLogon 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ 38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ Dxpserver.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ Dxpserver.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ Dxpserver.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x0007000000023cc4-15.dat autoit_exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 536 set thread context of 4916 536 38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe 83 PID 2332 set thread context of 1124 2332 Dxpserver.exe 102 PID 2492 set thread context of 2232 2492 Dxpserver.exe 111 PID 2156 set thread context of 1928 2156 Dxpserver.exe 117 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dxpserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dxpserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dxpserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dxpserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dxpserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dxpserver.exe -
Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings Dxpserver.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings 38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings Dxpserver.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings Dxpserver.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1080 schtasks.exe 2464 schtasks.exe 4960 schtasks.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 536 wrote to memory of 4916 536 38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe 83 PID 536 wrote to memory of 4916 536 38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe 83 PID 536 wrote to memory of 4916 536 38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe 83 PID 536 wrote to memory of 4916 536 38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe 83 PID 536 wrote to memory of 4916 536 38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe 83 PID 4916 wrote to memory of 4960 4916 38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe 84 PID 4916 wrote to memory of 4960 4916 38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe 84 PID 4916 wrote to memory of 4960 4916 38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe 84 PID 536 wrote to memory of 1080 536 38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe 93 PID 536 wrote to memory of 1080 536 38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe 93 PID 536 wrote to memory of 1080 536 38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe 93 PID 2332 wrote to memory of 1124 2332 Dxpserver.exe 102 PID 2332 wrote to memory of 1124 2332 Dxpserver.exe 102 PID 2332 wrote to memory of 1124 2332 Dxpserver.exe 102 PID 2332 wrote to memory of 1124 2332 Dxpserver.exe 102 PID 2332 wrote to memory of 1124 2332 Dxpserver.exe 102 PID 1124 wrote to memory of 5084 1124 Dxpserver.exe 103 PID 1124 wrote to memory of 5084 1124 Dxpserver.exe 103 PID 1124 wrote to memory of 5084 1124 Dxpserver.exe 103 PID 2332 wrote to memory of 2464 2332 Dxpserver.exe 108 PID 2332 wrote to memory of 2464 2332 Dxpserver.exe 108 PID 2332 wrote to memory of 2464 2332 Dxpserver.exe 108 PID 2492 wrote to memory of 2232 2492 Dxpserver.exe 111 PID 2492 wrote to memory of 2232 2492 Dxpserver.exe 111 PID 2492 wrote to memory of 2232 2492 Dxpserver.exe 111 PID 2492 wrote to memory of 2232 2492 Dxpserver.exe 111 PID 2492 wrote to memory of 2232 2492 Dxpserver.exe 111 PID 2232 wrote to memory of 1108 2232 Dxpserver.exe 112 PID 2232 wrote to memory of 1108 2232 Dxpserver.exe 112 PID 2232 wrote to memory of 1108 2232 Dxpserver.exe 112 PID 2492 wrote to memory of 4960 2492 Dxpserver.exe 114 PID 2492 wrote to memory of 4960 2492 Dxpserver.exe 114 PID 2492 wrote to memory of 4960 2492 Dxpserver.exe 114 PID 2156 wrote to memory of 1928 2156 Dxpserver.exe 117 PID 2156 wrote to memory of 1928 2156 Dxpserver.exe 117 PID 2156 wrote to memory of 1928 2156 Dxpserver.exe 117 PID 2156 wrote to memory of 1928 2156 Dxpserver.exe 117 PID 2156 wrote to memory of 1928 2156 Dxpserver.exe 117 PID 1928 wrote to memory of 5100 1928 Dxpserver.exe 118 PID 1928 wrote to memory of 5100 1928 Dxpserver.exe 118 PID 1928 wrote to memory of 5100 1928 Dxpserver.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe"C:\Users\Admin\AppData\Local\Temp\38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Users\Admin\AppData\Local\Temp\38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe"C:\Users\Admin\AppData\Local\Temp\38052ddd9c64e44bd2631ae021c1e973bed0ddfc8be6c3b2714011647c551d53.exe"2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- System Location Discovery: System Language Discovery
PID:4960
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn cttunesvr /tr "C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe" /sc minute /mo 1 /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1080
-
-
C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exeC:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe"C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe"2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- System Location Discovery: System Language Discovery
PID:5084
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn cttunesvr /tr "C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe" /sc minute /mo 1 /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2464
-
-
C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exeC:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe"C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe"2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- System Location Discovery: System Language Discovery
PID:1108
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn cttunesvr /tr "C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe" /sc minute /mo 1 /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4960
-
-
C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exeC:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe"C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe"2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- System Location Discovery: System Language Discovery
PID:5100
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
658B
MD56e5dc5303fa3191374430f5a32236fdb
SHA18fc15d0baf88a969c44543205208a2de14805104
SHA256242e48c1ff0a20dfc8feec5bf685c31d6e6356cb931d9f51b3e8ff685c761998
SHA5126beb5430acc8bacf92a6d6bbed03dc163536c7aea1499d36b2580da683f4353cd4ca34dceff8e870c622c9f49ada1b66eb44a605e40e7949f1ce76cc52dde353
-
Filesize
564B
MD5e221e7bd7e33aef4a5264f798818142e
SHA13545dbcc35de80c8f15da0daceab80acd0f1ae22
SHA256f37e43a3504c163fa4a82bacc92ceb8cccd37d1020fbba95cc954f316ce49516
SHA51204775d0fa21526bbbaa2deea13af1d5fab6183ea3a2809073539293da78e20f1cf4b9a4afdeafb1b4e8ce17a5be40f44364808ab73c174c98bce53ad8a1807d8
-
Filesize
1.1MB
MD51c9f20b6a7865d76806fa46774df672e
SHA1c715b5871584197d8b460b8ac940562f188d71b9
SHA256e9d79115b1c0e17d4712c6927d8a2894105030c350da8ffc07c6d572de840bf7
SHA5121dc166f6ab6937c697cc679c4e0e299e073aa836a54ba7e5ce509b98b3e74fc51fb289ef9d90d0ffe593c3187422b102807fca4f6bd82b90eeb6326de88136b7