Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/02/2024, 11:31

General

  • Target

    rORDERCONFIRMATION93892873984883782.exe

  • Size

    1.0MB

  • MD5

    e5d2981fd9c531b3cfb780cf781bac91

  • SHA1

    aaf7084c369138eb5588051eda8aec9aa3c4ac26

  • SHA256

    3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b

  • SHA512

    ec10e5de423564c17caac9e3c8a4ab2d1ed51882c9cfe145374d69e9f18382d7bd23d370f0389fb56c3b77073da11351978e803dc53c7135e618bbf0507be539

  • SSDEEP

    24576:Aazz87bccsW43UyDBU7RCFYK9i3iOpOnC+yqiQDi/DtS:AOz8732BdUCYK9i3X6CPqinDo

Malware Config

Extracted

Family

remcos

Botnet

P2-bin

C2

84.38.132.126:61445

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-ANE1CN

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • NirSoft MailPassView 2 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 2 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 6 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\rORDERCONFIRMATION93892873984883782.exe
    "C:\Users\Admin\AppData\Local\Temp\rORDERCONFIRMATION93892873984883782.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2532
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\rORDERCONFIRMATION93892873984883782.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2268
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\bZurkfs.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4196
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bZurkfs" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8722.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:3384
    • C:\Users\Admin\AppData\Local\Temp\rORDERCONFIRMATION93892873984883782.exe
      "C:\Users\Admin\AppData\Local\Temp\rORDERCONFIRMATION93892873984883782.exe"
      2⤵
        PID:3872
      • C:\Users\Admin\AppData\Local\Temp\rORDERCONFIRMATION93892873984883782.exe
        "C:\Users\Admin\AppData\Local\Temp\rORDERCONFIRMATION93892873984883782.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2476
        • C:\Users\Admin\AppData\Local\Temp\rORDERCONFIRMATION93892873984883782.exe
          C:\Users\Admin\AppData\Local\Temp\rORDERCONFIRMATION93892873984883782.exe /stext "C:\Users\Admin\AppData\Local\Temp\xlegzwespnpqwugpxhaftvtiiiz"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4988
        • C:\Users\Admin\AppData\Local\Temp\rORDERCONFIRMATION93892873984883782.exe
          C:\Users\Admin\AppData\Local\Temp\rORDERCONFIRMATION93892873984883782.exe /stext "C:\Users\Admin\AppData\Local\Temp\ifrzsopudvhvzautorngwaorrxjrcf"
          3⤵
          • Accesses Microsoft Outlook accounts
          PID:4468
        • C:\Users\Admin\AppData\Local\Temp\rORDERCONFIRMATION93892873984883782.exe
          C:\Users\Admin\AppData\Local\Temp\rORDERCONFIRMATION93892873984883782.exe /stext "C:\Users\Admin\AppData\Local\Temp\kzwjtzhnrdzajgqxycaihmiirdaavqdfi"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2080
        • C:\Users\Admin\AppData\Local\Temp\rORDERCONFIRMATION93892873984883782.exe
          C:\Users\Admin\AppData\Local\Temp\rORDERCONFIRMATION93892873984883782.exe /stext "C:\Users\Admin\AppData\Local\Temp\kzwjtzhnrdzajgqxycaihmiirdaavqdfi"
          3⤵
            PID:1804

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\remcos\logs.dat

        Filesize

        144B

        MD5

        f636871dba54f24c08cda0828e1c1d8c

        SHA1

        77ca38aa8ff07ba95ee17cefa411622179c77c85

        SHA256

        690e30c8368315325026f89750c2f5993727700fa2862e02787a5ed9b5293d6a

        SHA512

        55b118d9f3f2f7dc6faa244627f389ac31af239c72f981176c428ee22b9734fd375aa1f41a231564674e84c18e555ce7925f7ac23b6c2a79ccae87e0f8df879d

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

        Filesize

        2KB

        MD5

        968cb9309758126772781b83adb8a28f

        SHA1

        8da30e71accf186b2ba11da1797cf67f8f78b47c

        SHA256

        92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

        SHA512

        4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        18KB

        MD5

        585c600c9348775e4970297f935696a7

        SHA1

        96839c4df94378eca303f2a067ba1ffacfbb4ab1

        SHA256

        97dbcb38a4df35e5c0c8a4d6495917d44991dffe2d2f2eb25604ec7e1028e0b7

        SHA512

        74d1807720de8bcad00e5b7904fcd9d1c20bd51b7044f098eb222c529e9e8f2dd6a6036b8f93fddf2f943517488dd412c5c07d5f8f0f2372b053f4b3c08627ba

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_phrtzxx3.hjc.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Users\Admin\AppData\Local\Temp\tmp8722.tmp

        Filesize

        1KB

        MD5

        64126d5147d5d30cd5c60c324a94606c

        SHA1

        376aab5990b79526c7a218dcc8eb9594c6d3bb86

        SHA256

        112cac119307c519fa55120d14fbaf8e5ea13fa6e87c76fa5b5f58115974bfa2

        SHA512

        7ac74044df24918156ea4a6e5188a682caf0667a21353cf25e2281a8357d2d4ace49b46e5bb1cdc478aa2509f661edfdfa1cc1aaf14fe78e818be83b58296f3c

      • C:\Users\Admin\AppData\Local\Temp\xlegzwespnpqwugpxhaftvtiiiz

        Filesize

        4KB

        MD5

        5c45226c7bdcd87ae920b1717198c4a4

        SHA1

        1ddd033bc2e4398dfd19ba5cb321e05b293e7ab6

        SHA256

        a3a582b7b4e21cb54fa5c7a2f0e39d10a4c12de1c376d86e909d9c7b3047287f

        SHA512

        67596b4b7bdd3cfad64fa205cb9b74a6d4f5f4b3efd3eb47a68d831e8a342d7ffb784d8a19a4f845ed86c6f3683ea9286cf5eed59b8e5d8c2f487d1a5f8abb2c

      • memory/2080-118-0x0000000000400000-0x0000000000424000-memory.dmp

        Filesize

        144KB

      • memory/2080-116-0x0000000000400000-0x0000000000424000-memory.dmp

        Filesize

        144KB

      • memory/2080-113-0x0000000000400000-0x0000000000424000-memory.dmp

        Filesize

        144KB

      • memory/2080-105-0x0000000000400000-0x0000000000424000-memory.dmp

        Filesize

        144KB

      • memory/2268-88-0x00000000069B0000-0x00000000069CE000-memory.dmp

        Filesize

        120KB

      • memory/2268-57-0x0000000005A40000-0x0000000005A5E000-memory.dmp

        Filesize

        120KB

      • memory/2268-16-0x0000000074CB0000-0x0000000075460000-memory.dmp

        Filesize

        7.7MB

      • memory/2268-17-0x0000000002220000-0x0000000002230000-memory.dmp

        Filesize

        64KB

      • memory/2268-19-0x0000000002220000-0x0000000002230000-memory.dmp

        Filesize

        64KB

      • memory/2268-143-0x0000000074CB0000-0x0000000075460000-memory.dmp

        Filesize

        7.7MB

      • memory/2268-20-0x0000000004C50000-0x0000000005278000-memory.dmp

        Filesize

        6.2MB

      • memory/2268-137-0x0000000007090000-0x0000000007098000-memory.dmp

        Filesize

        32KB

      • memory/2268-136-0x00000000070B0000-0x00000000070CA000-memory.dmp

        Filesize

        104KB

      • memory/2268-135-0x0000000006FB0000-0x0000000006FC4000-memory.dmp

        Filesize

        80KB

      • memory/2268-134-0x0000000006FA0000-0x0000000006FAE000-memory.dmp

        Filesize

        56KB

      • memory/2268-25-0x0000000004BB0000-0x0000000004BD2000-memory.dmp

        Filesize

        136KB

      • memory/2268-26-0x00000000053B0000-0x0000000005416000-memory.dmp

        Filesize

        408KB

      • memory/2268-127-0x0000000002220000-0x0000000002230000-memory.dmp

        Filesize

        64KB

      • memory/2268-120-0x0000000006DE0000-0x0000000006DEA000-memory.dmp

        Filesize

        40KB

      • memory/2268-27-0x0000000005420000-0x0000000005486000-memory.dmp

        Filesize

        408KB

      • memory/2268-117-0x0000000074CB0000-0x0000000075460000-memory.dmp

        Filesize

        7.7MB

      • memory/2268-58-0x0000000005AD0000-0x0000000005B1C000-memory.dmp

        Filesize

        304KB

      • memory/2268-15-0x0000000002150000-0x0000000002186000-memory.dmp

        Filesize

        216KB

      • memory/2268-70-0x0000000075540000-0x000000007558C000-memory.dmp

        Filesize

        304KB

      • memory/2268-92-0x0000000002220000-0x0000000002230000-memory.dmp

        Filesize

        64KB

      • memory/2268-69-0x000000007F390000-0x000000007F3A0000-memory.dmp

        Filesize

        64KB

      • memory/2476-55-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2476-62-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2476-173-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2476-172-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2476-59-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2476-60-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2476-61-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2476-165-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2476-63-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2476-64-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2476-65-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2476-66-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2476-164-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2476-157-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2476-50-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2476-156-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2476-54-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2476-130-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2476-128-0x0000000010000000-0x0000000010019000-memory.dmp

        Filesize

        100KB

      • memory/2476-51-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2476-73-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2476-149-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2476-126-0x0000000010000000-0x0000000010019000-memory.dmp

        Filesize

        100KB

      • memory/2476-131-0x0000000010000000-0x0000000010019000-memory.dmp

        Filesize

        100KB

      • memory/2476-47-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2476-129-0x0000000010000000-0x0000000010019000-memory.dmp

        Filesize

        100KB

      • memory/2476-148-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2476-33-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2476-146-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2476-123-0x0000000010000000-0x0000000010019000-memory.dmp

        Filesize

        100KB

      • memory/2476-56-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2532-7-0x0000000007AA0000-0x0000000007AB4000-memory.dmp

        Filesize

        80KB

      • memory/2532-9-0x000000000A820000-0x000000000A82E000-memory.dmp

        Filesize

        56KB

      • memory/2532-6-0x000000000A390000-0x000000000A42C000-memory.dmp

        Filesize

        624KB

      • memory/2532-3-0x00000000078C0000-0x0000000007952000-memory.dmp

        Filesize

        584KB

      • memory/2532-18-0x0000000074CB0000-0x0000000075460000-memory.dmp

        Filesize

        7.7MB

      • memory/2532-4-0x0000000007AB0000-0x0000000007AC0000-memory.dmp

        Filesize

        64KB

      • memory/2532-10-0x000000000A910000-0x000000000A9D6000-memory.dmp

        Filesize

        792KB

      • memory/2532-2-0x0000000007DD0000-0x0000000008374000-memory.dmp

        Filesize

        5.6MB

      • memory/2532-5-0x0000000007970000-0x000000000797A000-memory.dmp

        Filesize

        40KB

      • memory/2532-8-0x000000000A810000-0x000000000A81A000-memory.dmp

        Filesize

        40KB

      • memory/2532-52-0x0000000074CB0000-0x0000000075460000-memory.dmp

        Filesize

        7.7MB

      • memory/2532-0-0x0000000000A40000-0x0000000000B4A000-memory.dmp

        Filesize

        1.0MB

      • memory/2532-21-0x0000000007AB0000-0x0000000007AC0000-memory.dmp

        Filesize

        64KB

      • memory/2532-1-0x0000000074CB0000-0x0000000075460000-memory.dmp

        Filesize

        7.7MB

      • memory/4196-114-0x0000000007440000-0x000000000745A000-memory.dmp

        Filesize

        104KB

      • memory/4196-144-0x0000000074CB0000-0x0000000075460000-memory.dmp

        Filesize

        7.7MB

      • memory/4196-132-0x00000000076C0000-0x0000000007756000-memory.dmp

        Filesize

        600KB

      • memory/4196-133-0x0000000007640000-0x0000000007651000-memory.dmp

        Filesize

        68KB

      • memory/4196-98-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

        Filesize

        64KB

      • memory/4196-23-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

        Filesize

        64KB

      • memory/4196-22-0x0000000074CB0000-0x0000000075460000-memory.dmp

        Filesize

        7.7MB

      • memory/4196-67-0x000000007FA10000-0x000000007FA20000-memory.dmp

        Filesize

        64KB

      • memory/4196-68-0x00000000070C0000-0x00000000070F2000-memory.dmp

        Filesize

        200KB

      • memory/4196-48-0x0000000005B80000-0x0000000005ED4000-memory.dmp

        Filesize

        3.3MB

      • memory/4196-71-0x0000000075540000-0x000000007558C000-memory.dmp

        Filesize

        304KB

      • memory/4196-95-0x0000000007300000-0x00000000073A3000-memory.dmp

        Filesize

        652KB

      • memory/4196-112-0x0000000007A80000-0x00000000080FA000-memory.dmp

        Filesize

        6.5MB

      • memory/4196-96-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

        Filesize

        64KB

      • memory/4468-104-0x0000000000400000-0x0000000000457000-memory.dmp

        Filesize

        348KB

      • memory/4468-115-0x0000000000400000-0x0000000000457000-memory.dmp

        Filesize

        348KB

      • memory/4468-111-0x0000000000400000-0x0000000000457000-memory.dmp

        Filesize

        348KB

      • memory/4468-99-0x0000000000400000-0x0000000000457000-memory.dmp

        Filesize

        348KB

      • memory/4988-94-0x0000000000400000-0x0000000000478000-memory.dmp

        Filesize

        480KB

      • memory/4988-121-0x0000000000400000-0x0000000000478000-memory.dmp

        Filesize

        480KB

      • memory/4988-100-0x0000000000400000-0x0000000000478000-memory.dmp

        Filesize

        480KB

      • memory/4988-103-0x0000000000400000-0x0000000000478000-memory.dmp

        Filesize

        480KB