Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

RariCapita....1.exe

windows7_x64

10

RariCapita....1.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    159s
  • max time network
    163s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    18/02/2022, 06:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RariCapital-Market-App-v2.1.1.exe

  • Size

    119.7MB

  • MD5

    66cf17cef0fa02c78363850fa888017b

  • SHA1

    255735f0107fd4c101e7f53820f78d0889cd4bc4

  • SHA256

    c4c4907ba3a60d331c7bfa836babe276a4166a889ca734a3f40916ace8a80f9d

  • SHA512

    f14e074aad2a5c7db1e5256f73cad0c27199eb3eb60c2f9040336996717fa7c6456015c1995a04f61fb436b192eb86580b452acb7cf18d5c1520afc46305bd15

Score
10/10
babadedaremcossys32crypterloaderpersistencerat

Malware Config

Extracted

Family

remcos

Botnet

Sys32

C2

157.90.1.54:4783

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    true

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    Logs

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Sys-CZ7MI0

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    notepad;solitaire;

Signatures

  • Babadeda

    Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.

    loadercrypterbabadeda
  • Babadeda Crypter 2 IoCs
  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Executes dropped EXE 4 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Loads dropped DLL 10 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 51 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RariCapital-Market-App-v2.1.1.exe
    "C:\Users\Admin\AppData\Local\Temp\RariCapital-Market-App-v2.1.1.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3020
    • C:\Users\Admin\AppData\Local\Temp\is-N4UOQ.tmp\RariCapital-Market-App-v2.1.1.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-N4UOQ.tmp\RariCapital-Market-App-v2.1.1.tmp" /SL5="$C0182,124691941,893952,C:\Users\Admin\AppData\Local\Temp\RariCapital-Market-App-v2.1.1.exe"
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:652
      • C:\Users\Admin\AppData\Local\Temp\RariCapital-Market-App-v2.1.1.exe
        "C:\Users\Admin\AppData\Local\Temp\RariCapital-Market-App-v2.1.1.exe" /VERYSILENT
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2852
        • C:\Users\Admin\AppData\Local\Temp\is-VC3S8.tmp\RariCapital-Market-App-v2.1.1.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-VC3S8.tmp\RariCapital-Market-App-v2.1.1.tmp" /SL5="$A01C2,124691941,893952,C:\Users\Admin\AppData\Local\Temp\RariCapital-Market-App-v2.1.1.exe" /VERYSILENT
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1580
          • C:\Users\Admin\AppData\Local\Markdown Monster\nmake.exe
            "C:\Users\Admin\AppData\Local\Markdown Monster\nmake.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1980
          • C:\Users\Admin\AppData\Local\Markdown Monster\PDapp.exe
            "C:\Users\Admin\AppData\Local\Markdown Monster\PDapp.exe"
            5⤵
            • Executes dropped EXE
            • Drops startup file
            • Loads dropped DLL
            • Adds Run key to start application
            • Suspicious use of SetWindowsHookEx
            PID:3856
  • C:\Windows\system32\MusNotifyIcon.exe
    %systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
    1⤵
    • Checks processor information in registry
    PID:2216
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x150 0x2c8
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:712
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p
    1⤵
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    PID:1368
  • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
    C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:756

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/652-134-0x0000000002710000-0x0000000002711000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1580-138-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2852-135-0x0000000000400000-0x00000000004E8000-memory.dmp

    Filesize

    928KB

    Download

  • memory/3020-133-0x0000000000401000-0x00000000004B7000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3020-130-0x0000000000400000-0x00000000004E8000-memory.dmp

    Filesize

    928KB

    Download

  • memory/3856-163-0x0000000009480000-0x00000000094FA000-memory.dmp

    Filesize

    488KB

    Download

  • memory/3856-169-0x0000000005280000-0x0000000009480000-memory.dmp

    Filesize

    66.0MB

    Download