Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

DefaultSetup.exe

windows11-21h2-x64

10

Resubmissions

28/01/2025, 16:47 UTC

250128-vanswsxqfq 10

28/01/2025, 16:19 UTC

250128-tshtxsxlcl 7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DefaultSetup.exe

  • Size

    78.0MB

  • Sample

    250128-vanswsxqfq

  • MD5

    d0b01f170c486dafffb1b6e595273a67

  • SHA1

    8bed0d7608ca48eca93e8c955e9410901ba04a49

  • SHA256

    7200d36264736d7fc359ad02b0ee625d964b71e058b034f9e014f13925138065

  • SHA512

    a571997430bb6675a4a546142e8445e44e53e4b1080b8048e6c08fa1ee42ccf1b4613cdd7a6249fe0c28beb836f5f8b2696a324d03d06d6bf06d5ffe466e872f

  • SSDEEP

    1572864:gb2/JSxJiUbUOXCSspU3UIBftflSBthJBpXl/S3fBzB:gDIOXuYU+fIBhTV/wfB

Score
10/10
remcosremotehostdiscoveryexecutionrat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

185.7.214.250:2426

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    GLOBAL

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    GLOBAL-SZBC6C

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      DefaultSetup.exe

    • Size

      78.0MB

    • MD5

      d0b01f170c486dafffb1b6e595273a67

    • SHA1

      8bed0d7608ca48eca93e8c955e9410901ba04a49

    • SHA256

      7200d36264736d7fc359ad02b0ee625d964b71e058b034f9e014f13925138065

    • SHA512

      a571997430bb6675a4a546142e8445e44e53e4b1080b8048e6c08fa1ee42ccf1b4613cdd7a6249fe0c28beb836f5f8b2696a324d03d06d6bf06d5ffe466e872f

    • SSDEEP

      1572864:gb2/JSxJiUbUOXCSspU3UIBftflSBthJBpXl/S3fBzB:gDIOXuYU+fIBhTV/wfB

    Score
    10/10
    remcosremotehostdiscoveryexecutionrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Remcos family

      remcos

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates processes with tasklist

      discovery

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.