Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    210s
  • max time network
    217s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/10/2023, 19:42

General

  • Target

    a8675b7771b427cbe2c487a42b9eace0_exe32.exe

  • Size

    583KB

  • MD5

    a8675b7771b427cbe2c487a42b9eace0

  • SHA1

    b9287d8b2c6fc60e751f1d07f21e9e93b548d01d

  • SHA256

    04344db47249ed5be999f50ca0e356a81fbb95a3480259b22be739896205d885

  • SHA512

    b9c3357cdea4c1605af62f2a447fb82b72262f42745b079a15afe4df6c5101738d51a48163674a2f3eda47b2dc8041e506d3bde83c549757d783f7d9915d1015

  • SSDEEP

    12288:IXSP7r9r/+ppppppppppppppppppppppppppppp0YubSkenVeUQnoOMHi0VcbPa:IXS1Mu+1nVeEija

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

80.76.51.172:8087

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-B8L4R0

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • NirSoft MailPassView 4 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 6 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 15 IoCs
  • Executes dropped EXE 11 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 17 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses Microsoft Outlook accounts 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: MapViewOfSection 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a8675b7771b427cbe2c487a42b9eace0_exe32.exe
    "C:\Users\Admin\AppData\Local\Temp\a8675b7771b427cbe2c487a42b9eace0_exe32.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4832
    • C:\Users\Admin\AppData\Local\Temp\xyazripk.exe
      "C:\Users\Admin\AppData\Local\Temp\xyazripk.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2356
      • C:\Users\Admin\AppData\Local\Temp\xyazripk.exe
        "C:\Users\Admin\AppData\Local\Temp\xyazripk.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1520
        • C:\Users\Admin\AppData\Local\Temp\xyazripk.exe
          C:\Users\Admin\AppData\Local\Temp\xyazripk.exe /stext "C:\Users\Admin\AppData\Local\Temp\areeuqqpoerty"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:2416
        • C:\Users\Admin\AppData\Local\Temp\xyazripk.exe
          C:\Users\Admin\AppData\Local\Temp\xyazripk.exe /stext "C:\Users\Admin\AppData\Local\Temp\ktjpvjjqkmjyicls"
          4⤵
          • Executes dropped EXE
          • Accesses Microsoft Outlook accounts
          PID:3016
        • C:\Users\Admin\AppData\Local\Temp\xyazripk.exe
          C:\Users\Admin\AppData\Local\Temp\xyazripk.exe /stext "C:\Users\Admin\AppData\Local\Temp\unohwbukyubdkjhwdxma"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4848
        • C:\Users\Admin\AppData\Local\Temp\xyazripk.exe
          C:\Users\Admin\AppData\Local\Temp\xyazripk.exe /stext "C:\Users\Admin\AppData\Local\Temp\pckzsagv"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:1740
        • C:\Users\Admin\AppData\Local\Temp\xyazripk.exe
          C:\Users\Admin\AppData\Local\Temp\xyazripk.exe /stext "C:\Users\Admin\AppData\Local\Temp\rxqrtsrxazx"
          4⤵
          • Executes dropped EXE
          • Accesses Microsoft Outlook accounts
          PID:3704
        • C:\Users\Admin\AppData\Local\Temp\xyazripk.exe
          C:\Users\Admin\AppData\Local\Temp\xyazripk.exe /stext "C:\Users\Admin\AppData\Local\Temp\czvktlbrohpojew"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:584
        • C:\Users\Admin\AppData\Local\Temp\xyazripk.exe
          C:\Users\Admin\AppData\Local\Temp\xyazripk.exe /stext "C:\Users\Admin\AppData\Local\Temp\worbqswcbeuhvftqgjohuwqxqcimofkeke"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:4476
        • C:\Users\Admin\AppData\Local\Temp\xyazripk.exe
          C:\Users\Admin\AppData\Local\Temp\xyazripk.exe /stext "C:\Users\Admin\AppData\Local\Temp\jkjfrvrxlu"
          4⤵
          • Executes dropped EXE
          • Accesses Microsoft Outlook accounts
          PID:1028
        • C:\Users\Admin\AppData\Local\Temp\xyazripk.exe
          C:\Users\Admin\AppData\Local\Temp\xyazripk.exe /stext "C:\Users\Admin\AppData\Local\Temp\tepxsnczzcwes"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4100

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\remcos\logs.dat

    Filesize

    144B

    MD5

    4d43eb566012e8eef612f7a757bd22ec

    SHA1

    7c8bda1990f56a4669d51c8de6a32a053cec8354

    SHA256

    b7d3dae57ad2cf98328cf196fa2a45de329591cbe651a654af4841612fe8510d

    SHA512

    eff074e36c45be45ff1d1b4366bfee0164e381fce4c40d5033a5ca6dcec3b837be9cb9b26dc13f43fd1570bdaa8ea4305031c7233651918f99a1c66f50c2edbf

  • C:\Users\Admin\AppData\Local\Temp\bhv57BB.tmp

    Filesize

    14.0MB

    MD5

    90367d01a1d79c6a5257f69508cee22c

    SHA1

    f73e18b666907e5c59625b94d48cffa66c6798f5

    SHA256

    a4a39740524e5335dbd731a534a189010b7d281aaba7c494488f1c07052e7df7

    SHA512

    f18514a72be3d201dfa40fe150bba96887cd6adcc8b215c064f2a13662eb28eab5ea29135e7c595263bd5ea1694b16dced4a42c0cb22cf49768de8ef71cc3ae9

  • C:\Users\Admin\AppData\Local\Temp\bmywfyfbdj.zp

    Filesize

    252KB

    MD5

    994b4b6e9d714c1f876217cf54a14cee

    SHA1

    206bb410c06ff767b207e72a29a002cce45f3a1b

    SHA256

    a1d111c3d0795d98269e2349d5b132a33abca9c6822e031cdc3c17df9fbad093

    SHA512

    f347e629f4997bae6208d9897bc5d904e230682fa5586e0c26dc4ac50435ecb1a6c57eaac1d09afc929e320850838bc89cc08a2d7088742957c9895379d824a8

  • C:\Users\Admin\AppData\Local\Temp\worbqswcbeuhvftqgjohuwqxqcimofkeke

    Filesize

    4KB

    MD5

    54256016ad499fd79eec3ef68594cace

    SHA1

    070a70ae09608ff5df35f26736a583476b35c59a

    SHA256

    085e41325891f7cea84e942500532a18057ff766dd54ef67ff6b08f133e5d54a

    SHA512

    8507d35255335ce453e679cc2da2481d246b41be2fdcca718e403db6c2676394dcc848cdde07e5fff0396dd5de5e4444dbd57394a99cc1e337f23fac34ded269

  • C:\Users\Admin\AppData\Local\Temp\xyazripk.exe

    Filesize

    196KB

    MD5

    0b22a7dc264dde13c042a09577df514c

    SHA1

    e73be0e8b35122dd3529b6cda90d0afd183073e9

    SHA256

    946ad114e0c0ecb7a86652ee6701c459e6cf33ddd40df1c15729456148f907fd

    SHA512

    a3f5bc52983843e5fb7f7f6671aa9e076ae6549d9a99dee6c395a38adc5f225608cd29e1c9ec70c25497c4e2f1ea54871f392fb893ee074a65a1e55faa88e43c

  • C:\Users\Admin\AppData\Local\Temp\xyazripk.exe

    Filesize

    196KB

    MD5

    0b22a7dc264dde13c042a09577df514c

    SHA1

    e73be0e8b35122dd3529b6cda90d0afd183073e9

    SHA256

    946ad114e0c0ecb7a86652ee6701c459e6cf33ddd40df1c15729456148f907fd

    SHA512

    a3f5bc52983843e5fb7f7f6671aa9e076ae6549d9a99dee6c395a38adc5f225608cd29e1c9ec70c25497c4e2f1ea54871f392fb893ee074a65a1e55faa88e43c

  • C:\Users\Admin\AppData\Local\Temp\xyazripk.exe

    Filesize

    196KB

    MD5

    0b22a7dc264dde13c042a09577df514c

    SHA1

    e73be0e8b35122dd3529b6cda90d0afd183073e9

    SHA256

    946ad114e0c0ecb7a86652ee6701c459e6cf33ddd40df1c15729456148f907fd

    SHA512

    a3f5bc52983843e5fb7f7f6671aa9e076ae6549d9a99dee6c395a38adc5f225608cd29e1c9ec70c25497c4e2f1ea54871f392fb893ee074a65a1e55faa88e43c

  • C:\Users\Admin\AppData\Local\Temp\xyazripk.exe

    Filesize

    196KB

    MD5

    0b22a7dc264dde13c042a09577df514c

    SHA1

    e73be0e8b35122dd3529b6cda90d0afd183073e9

    SHA256

    946ad114e0c0ecb7a86652ee6701c459e6cf33ddd40df1c15729456148f907fd

    SHA512

    a3f5bc52983843e5fb7f7f6671aa9e076ae6549d9a99dee6c395a38adc5f225608cd29e1c9ec70c25497c4e2f1ea54871f392fb893ee074a65a1e55faa88e43c

  • C:\Users\Admin\AppData\Local\Temp\xyazripk.exe

    Filesize

    196KB

    MD5

    0b22a7dc264dde13c042a09577df514c

    SHA1

    e73be0e8b35122dd3529b6cda90d0afd183073e9

    SHA256

    946ad114e0c0ecb7a86652ee6701c459e6cf33ddd40df1c15729456148f907fd

    SHA512

    a3f5bc52983843e5fb7f7f6671aa9e076ae6549d9a99dee6c395a38adc5f225608cd29e1c9ec70c25497c4e2f1ea54871f392fb893ee074a65a1e55faa88e43c

  • C:\Users\Admin\AppData\Local\Temp\xyazripk.exe

    Filesize

    196KB

    MD5

    0b22a7dc264dde13c042a09577df514c

    SHA1

    e73be0e8b35122dd3529b6cda90d0afd183073e9

    SHA256

    946ad114e0c0ecb7a86652ee6701c459e6cf33ddd40df1c15729456148f907fd

    SHA512

    a3f5bc52983843e5fb7f7f6671aa9e076ae6549d9a99dee6c395a38adc5f225608cd29e1c9ec70c25497c4e2f1ea54871f392fb893ee074a65a1e55faa88e43c

  • C:\Users\Admin\AppData\Local\Temp\xyazripk.exe

    Filesize

    196KB

    MD5

    0b22a7dc264dde13c042a09577df514c

    SHA1

    e73be0e8b35122dd3529b6cda90d0afd183073e9

    SHA256

    946ad114e0c0ecb7a86652ee6701c459e6cf33ddd40df1c15729456148f907fd

    SHA512

    a3f5bc52983843e5fb7f7f6671aa9e076ae6549d9a99dee6c395a38adc5f225608cd29e1c9ec70c25497c4e2f1ea54871f392fb893ee074a65a1e55faa88e43c

  • C:\Users\Admin\AppData\Local\Temp\xyazripk.exe

    Filesize

    196KB

    MD5

    0b22a7dc264dde13c042a09577df514c

    SHA1

    e73be0e8b35122dd3529b6cda90d0afd183073e9

    SHA256

    946ad114e0c0ecb7a86652ee6701c459e6cf33ddd40df1c15729456148f907fd

    SHA512

    a3f5bc52983843e5fb7f7f6671aa9e076ae6549d9a99dee6c395a38adc5f225608cd29e1c9ec70c25497c4e2f1ea54871f392fb893ee074a65a1e55faa88e43c

  • C:\Users\Admin\AppData\Local\Temp\xyazripk.exe

    Filesize

    196KB

    MD5

    0b22a7dc264dde13c042a09577df514c

    SHA1

    e73be0e8b35122dd3529b6cda90d0afd183073e9

    SHA256

    946ad114e0c0ecb7a86652ee6701c459e6cf33ddd40df1c15729456148f907fd

    SHA512

    a3f5bc52983843e5fb7f7f6671aa9e076ae6549d9a99dee6c395a38adc5f225608cd29e1c9ec70c25497c4e2f1ea54871f392fb893ee074a65a1e55faa88e43c

  • C:\Users\Admin\AppData\Local\Temp\xyazripk.exe

    Filesize

    196KB

    MD5

    0b22a7dc264dde13c042a09577df514c

    SHA1

    e73be0e8b35122dd3529b6cda90d0afd183073e9

    SHA256

    946ad114e0c0ecb7a86652ee6701c459e6cf33ddd40df1c15729456148f907fd

    SHA512

    a3f5bc52983843e5fb7f7f6671aa9e076ae6549d9a99dee6c395a38adc5f225608cd29e1c9ec70c25497c4e2f1ea54871f392fb893ee074a65a1e55faa88e43c

  • C:\Users\Admin\AppData\Local\Temp\xyazripk.exe

    Filesize

    196KB

    MD5

    0b22a7dc264dde13c042a09577df514c

    SHA1

    e73be0e8b35122dd3529b6cda90d0afd183073e9

    SHA256

    946ad114e0c0ecb7a86652ee6701c459e6cf33ddd40df1c15729456148f907fd

    SHA512

    a3f5bc52983843e5fb7f7f6671aa9e076ae6549d9a99dee6c395a38adc5f225608cd29e1c9ec70c25497c4e2f1ea54871f392fb893ee074a65a1e55faa88e43c

  • C:\Users\Admin\AppData\Local\Temp\xyazripk.exe

    Filesize

    196KB

    MD5

    0b22a7dc264dde13c042a09577df514c

    SHA1

    e73be0e8b35122dd3529b6cda90d0afd183073e9

    SHA256

    946ad114e0c0ecb7a86652ee6701c459e6cf33ddd40df1c15729456148f907fd

    SHA512

    a3f5bc52983843e5fb7f7f6671aa9e076ae6549d9a99dee6c395a38adc5f225608cd29e1c9ec70c25497c4e2f1ea54871f392fb893ee074a65a1e55faa88e43c

  • memory/584-77-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/1028-99-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/1520-80-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

  • memory/1520-14-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

  • memory/1520-137-0x0000000010000000-0x0000000010019000-memory.dmp

    Filesize

    100KB

  • memory/1520-132-0x0000000010000000-0x0000000010019000-memory.dmp

    Filesize

    100KB

  • memory/1520-129-0x0000000010000000-0x0000000010019000-memory.dmp

    Filesize

    100KB

  • memory/1520-8-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

  • memory/1520-11-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

  • memory/1520-12-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

  • memory/1520-15-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

  • memory/1520-17-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

  • memory/1520-40-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

  • memory/1520-18-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

  • memory/1520-19-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

  • memory/1520-20-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

  • memory/1520-52-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

  • memory/1520-53-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

  • memory/1520-54-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

  • memory/1520-55-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

  • memory/1520-23-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

  • memory/1520-21-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

  • memory/1740-124-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/1740-82-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2356-5-0x00000000005D0000-0x00000000005D2000-memory.dmp

    Filesize

    8KB

  • memory/2416-59-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2416-123-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2416-43-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2416-39-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2416-24-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/3016-45-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/3016-37-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/3016-27-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/3016-33-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/3704-73-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/4100-106-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/4476-122-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/4848-34-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/4848-36-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/4848-38-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/4848-41-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/4848-30-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB