Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/01/2023, 12:40

General

  • Target

    e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe

  • Size

    1.1MB

  • MD5

    d9b3775511c7538a73dfeaab0073b4b6

  • SHA1

    e3a64adc43c5c5c0bfc725344407433b4b497fa9

  • SHA256

    98479f2d5e3f5147ddd504bcc7bd1a2b0a3b06ff5525f313a55ce81efc67fc28

  • SHA512

    6b685246032b7c4a09f4df63dbc1282dfdd9822911744d9b9bcb4b135139a7a25b7d0daf30fd0b62b254ede16d010dbd18e8a8adef384bcfa11400a4605e6969

  • SSDEEP

    24576:QOwgbq09TF+lmP8iZ1P/wvDcm9puPYxsJ4gb:HrdDAvFYQsqgb

Score
10/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

51.75.209.245:2404

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-CMFPLR

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe
    "C:\Users\Admin\AppData\Local\Temp\e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:640
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3536
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\oCfQiTZ.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2140
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\oCfQiTZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp21E0.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:4868
    • C:\Users\Admin\AppData\Local\Temp\e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe
      "C:\Users\Admin\AppData\Local\Temp\e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe"
      2⤵
        PID:456
      • C:\Users\Admin\AppData\Local\Temp\e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe
        "C:\Users\Admin\AppData\Local\Temp\e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe"
        2⤵
        • Suspicious use of SetWindowsHookEx
        PID:4736

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      968cb9309758126772781b83adb8a28f

      SHA1

      8da30e71accf186b2ba11da1797cf67f8f78b47c

      SHA256

      92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

      SHA512

      4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

    • C:\Users\Admin\AppData\Local\Temp\tmp21E0.tmp

      Filesize

      1KB

      MD5

      badbd008911c2684c00657df8aadeb0f

      SHA1

      046def4ff1268f40065c3f8cb73ea7c5eb065219

      SHA256

      bc5fbeb32cec7d1952a7ede90fba3576427ac33218537bf78e9846568e19d382

      SHA512

      c023e25b500d9dc686f084a2056ae838e47aaf4d8534e82d6b3b9f3a4e251a80164392b265be6fffe1c4ace133dc97e6d01736d1df7458d0ada8a6f7d6a7d254

    • memory/640-132-0x0000000000AB0000-0x0000000000BD8000-memory.dmp

      Filesize

      1.2MB

    • memory/640-134-0x00000000055A0000-0x0000000005632000-memory.dmp

      Filesize

      584KB

    • memory/640-135-0x0000000005570000-0x000000000557A000-memory.dmp

      Filesize

      40KB

    • memory/640-133-0x0000000005C50000-0x00000000061F4000-memory.dmp

      Filesize

      5.6MB

    • memory/640-136-0x00000000094B0000-0x000000000954C000-memory.dmp

      Filesize

      624KB

    • memory/2140-160-0x0000000007250000-0x00000000072E6000-memory.dmp

      Filesize

      600KB

    • memory/2140-141-0x0000000004E80000-0x00000000054A8000-memory.dmp

      Filesize

      6.2MB

    • memory/2140-152-0x0000000005CD0000-0x0000000005CEE000-memory.dmp

      Filesize

      120KB

    • memory/2140-159-0x0000000007040000-0x000000000704A000-memory.dmp

      Filesize

      40KB

    • memory/2140-157-0x0000000007610000-0x0000000007C8A000-memory.dmp

      Filesize

      6.5MB

    • memory/2140-156-0x0000000006260000-0x000000000627E000-memory.dmp

      Filesize

      120KB

    • memory/2140-154-0x00000000732B0000-0x00000000732FC000-memory.dmp

      Filesize

      304KB

    • memory/2140-153-0x0000000006280000-0x00000000062B2000-memory.dmp

      Filesize

      200KB

    • memory/3536-140-0x00000000027C0000-0x00000000027F6000-memory.dmp

      Filesize

      216KB

    • memory/3536-162-0x0000000007730000-0x000000000774A000-memory.dmp

      Filesize

      104KB

    • memory/3536-163-0x0000000007710000-0x0000000007718000-memory.dmp

      Filesize

      32KB

    • memory/3536-144-0x00000000053C0000-0x0000000005426000-memory.dmp

      Filesize

      408KB

    • memory/3536-161-0x0000000007620000-0x000000000762E000-memory.dmp

      Filesize

      56KB

    • memory/3536-155-0x00000000732B0000-0x00000000732FC000-memory.dmp

      Filesize

      304KB

    • memory/3536-143-0x0000000005020000-0x0000000005042000-memory.dmp

      Filesize

      136KB

    • memory/3536-158-0x00000000073F0000-0x000000000740A000-memory.dmp

      Filesize

      104KB

    • memory/3536-146-0x0000000005AD0000-0x0000000005B36000-memory.dmp

      Filesize

      408KB

    • memory/4736-148-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/4736-150-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/4736-149-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/4736-151-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/4736-165-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB