Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    26/07/2024, 21:54

General

  • Target

    Shipping documents PO 16103 INV.exe

  • Size

    2.5MB

  • MD5

    671423091cbffb473016291d68a5b49b

  • SHA1

    07f1a0c895fa372f6043fbf013b78321a6939193

  • SHA256

    31fdf75cd3cf71f770eb158141183b08ed0845b27ecd2e90ce20eb3c4e4642c0

  • SHA512

    23782fee548af5a284ac9d833041604a4e1965df0c7f7bad6f4eaa7c1f13a0712c2d3218b868c06cb7779df57ec2f79fdb1dcc1b9f951cda95fa095e925f486e

  • SSDEEP

    49152:Qg7eO7kjTav5AwVZGKY3uS+s1vm1lOt+2QpTay:F7lQfjQd

Malware Config

Extracted

Family

remcos

Botnet

Dollar Man

C2

178.23.190.118:52499

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-SJ9MVF

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Detected Nirsoft tools 9 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView 3 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 3 IoCs

    Password recovery tool for various web browsers

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Shipping documents PO 16103 INV.exe
    "C:\Users\Admin\AppData\Local\Temp\Shipping documents PO 16103 INV.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Network Configuration Discovery: Internet Connection Discovery
    • Suspicious use of WriteProcessMemory
    PID:2276
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2760
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe /stext "C:\Users\Admin\AppData\Local\Temp\kzyxjaaocn"
        3⤵
          PID:2540
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe /stext "C:\Users\Admin\AppData\Local\Temp\kzyxjaaocn"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2548
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe /stext "C:\Users\Admin\AppData\Local\Temp\vcehktkqqvmzd"
          3⤵
            PID:2596
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe /stext "C:\Users\Admin\AppData\Local\Temp\vcehktkqqvmzd"
            3⤵
              PID:2616
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe /stext "C:\Users\Admin\AppData\Local\Temp\vcehktkqqvmzd"
              3⤵
              • Accesses Microsoft Outlook accounts
              • System Location Discovery: System Language Discovery
              PID:3012
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe /stext "C:\Users\Admin\AppData\Local\Temp\xwrallvkedemnagq"
              3⤵
                PID:2208
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe /stext "C:\Users\Admin\AppData\Local\Temp\xwrallvkedemnagq"
                3⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:3028

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\remcos\logs.dat

            Filesize

            144B

            MD5

            090a0cdc39ad7d708af09f3de76bac81

            SHA1

            58b700cf07d3ea2a1cac3aa4c1d0371a40815c2d

            SHA256

            8da9a32925fcc8db34fa2b93838c16d7a82a95c4530a1219210ac9a03cffdab1

            SHA512

            37ff0006276de1a7cedd1e86f4b9925525c64a801b4d5e63eee32300c270c4b06918b588a408f84fe6d57e0be9269f29dc9507ffb4581c88a0ceb402e1ae8684

          • C:\Users\Admin\AppData\Local\Temp\kzyxjaaocn

            Filesize

            2B

            MD5

            f3b25701fe362ec84616a93a45ce9998

            SHA1

            d62636d8caec13f04e28442a0a6fa1afeb024bbb

            SHA256

            b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

            SHA512

            98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

          • memory/2548-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

            Filesize

            4KB

          • memory/2548-41-0x0000000000400000-0x0000000000478000-memory.dmp

            Filesize

            480KB

          • memory/2548-24-0x0000000000400000-0x0000000000478000-memory.dmp

            Filesize

            480KB

          • memory/2548-20-0x0000000000400000-0x0000000000478000-memory.dmp

            Filesize

            480KB

          • memory/2548-19-0x0000000000400000-0x0000000000478000-memory.dmp

            Filesize

            480KB

          • memory/2548-17-0x0000000000400000-0x0000000000478000-memory.dmp

            Filesize

            480KB

          • memory/2760-53-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2760-0-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2760-14-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2760-12-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2760-10-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2760-9-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2760-7-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2760-85-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2760-86-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2760-8-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2760-77-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2760-70-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2760-69-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2760-61-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2760-62-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2760-2-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2760-55-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2760-52-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2760-3-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2760-5-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2760-11-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2760-45-0x0000000010000000-0x0000000010019000-memory.dmp

            Filesize

            100KB

          • memory/2760-48-0x0000000010000000-0x0000000010019000-memory.dmp

            Filesize

            100KB

          • memory/2760-49-0x0000000010000000-0x0000000010019000-memory.dmp

            Filesize

            100KB

          • memory/2760-50-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/3012-44-0x0000000000400000-0x0000000000462000-memory.dmp

            Filesize

            392KB

          • memory/3012-32-0x0000000000400000-0x0000000000462000-memory.dmp

            Filesize

            392KB

          • memory/3012-33-0x0000000000400000-0x0000000000462000-memory.dmp

            Filesize

            392KB

          • memory/3012-35-0x0000000000400000-0x0000000000462000-memory.dmp

            Filesize

            392KB

          • memory/3012-21-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

            Filesize

            4KB

          • memory/3012-23-0x0000000000400000-0x0000000000462000-memory.dmp

            Filesize

            392KB

          • memory/3028-36-0x0000000000400000-0x0000000000424000-memory.dmp

            Filesize

            144KB

          • memory/3028-29-0x0000000000400000-0x0000000000424000-memory.dmp

            Filesize

            144KB

          • memory/3028-30-0x0000000000400000-0x0000000000424000-memory.dmp

            Filesize

            144KB

          • memory/3028-34-0x0000000000400000-0x0000000000424000-memory.dmp

            Filesize

            144KB

          • memory/3028-27-0x0000000000400000-0x0000000000424000-memory.dmp

            Filesize

            144KB