Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    03/08/2024, 07:24

General

  • Target

    Geron Steel-Order-79376- Contract 2025.exe

  • Size

    96KB

  • MD5

    fdee96e631a0f8f3820671ecdaa13585

  • SHA1

    dc99e0841a7dd576ea1ce95eb2f36bf0dbf41582

  • SHA256

    32fd435938f24dbcb2c62c4d2fcf0c9ddc109dc35275510b202830d7a119d317

  • SHA512

    a86871fde648462f119b467dca7c2b43de6765ed4cb1a56835c98782039c514f169d81b9eab5c5887143a8ba780fe9f8ecf138441e96ccb47b4180bbd1dd87a8

  • SSDEEP

    1536:eRgg36JaaX+2V6G3F2M9O8n1YPyKpFKu1rEiXsY:Q36JL76G3F2l81YDT2ix

Malware Config

Extracted

Family

remcos

Botnet

Fresh

C2

taysour6lakut1.duckdns.org:1960

taysour6lakut1.duckdns.org:1961

taysour6lakut2.duckdns.org:1960

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    mzpos.dat

  • keylog_flag

    false

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    kmgvboirfg-VIHET7

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Detected Nirsoft tools 5 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView 1 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 3 IoCs

    Password recovery tool for various web browsers

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 60 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Geron Steel-Order-79376- Contract 2025.exe
    "C:\Users\Admin\AppData\Local\Temp\Geron Steel-Order-79376- Contract 2025.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2240
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2736
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe /stext "C:\Users\Admin\AppData\Local\Temp\yedrklregmegeyctwfxfv"
        3⤵
          PID:2856
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe /stext "C:\Users\Admin\AppData\Local\Temp\yedrklregmegeyctwfxfv"
          3⤵
            PID:2860
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe /stext "C:\Users\Admin\AppData\Local\Temp\yedrklregmegeyctwfxfv"
            3⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:2876
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe /stext "C:\Users\Admin\AppData\Local\Temp\iyqjldbxuuwlhmqfoqkggagi"
            3⤵
            • Accesses Microsoft Outlook accounts
            • System Location Discovery: System Language Discovery
            PID:3020
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe /stext "C:\Users\Admin\AppData\Local\Temp\tavumwmzqcoqrsmjxaxajnbrkotg"
            3⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:2284
        • C:\Windows\system32\cmd.exe
          "cmd.exe" /c schtasks /create /tn "CShopname" /tr "C:\Users\Admin\AppData\Roaming\NLoeschin.exe " /sc minute /mo 10 /f
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2976
          • C:\Windows\system32\schtasks.exe
            schtasks /create /tn "CShopname" /tr "C:\Users\Admin\AppData\Roaming\NLoeschin.exe " /sc minute /mo 10 /f
            3⤵
            • Scheduled Task/Job: Scheduled Task
            PID:1940

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\yedrklregmegeyctwfxfv

        Filesize

        2B

        MD5

        f3b25701fe362ec84616a93a45ce9998

        SHA1

        d62636d8caec13f04e28442a0a6fa1afeb024bbb

        SHA256

        b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

        SHA512

        98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

      • memory/2240-44-0x000007FEF5D20000-0x000007FEF670C000-memory.dmp

        Filesize

        9.9MB

      • memory/2240-1-0x0000000000FA0000-0x0000000000FBC000-memory.dmp

        Filesize

        112KB

      • memory/2240-18-0x0000000000460000-0x000000000046A000-memory.dmp

        Filesize

        40KB

      • memory/2240-19-0x000007FEF5D20000-0x000007FEF670C000-memory.dmp

        Filesize

        9.9MB

      • memory/2240-0-0x000007FEF5D23000-0x000007FEF5D24000-memory.dmp

        Filesize

        4KB

      • memory/2284-63-0x0000000000400000-0x0000000000424000-memory.dmp

        Filesize

        144KB

      • memory/2284-64-0x0000000000400000-0x0000000000424000-memory.dmp

        Filesize

        144KB

      • memory/2284-65-0x0000000000400000-0x0000000000424000-memory.dmp

        Filesize

        144KB

      • memory/2736-51-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2736-79-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2736-30-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2736-25-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2736-32-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2736-23-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2736-28-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2736-40-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2736-43-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2736-35-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2736-45-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2736-47-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2736-46-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2736-49-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2736-48-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2736-38-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2736-90-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2736-89-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2736-37-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2736-34-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

      • memory/2736-27-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2736-87-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2736-86-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2736-85-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2736-83-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2736-82-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2736-81-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2736-21-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2736-74-0x0000000010000000-0x0000000010019000-memory.dmp

        Filesize

        100KB

      • memory/2736-77-0x0000000010000000-0x0000000010019000-memory.dmp

        Filesize

        100KB

      • memory/2736-78-0x0000000010000000-0x0000000010019000-memory.dmp

        Filesize

        100KB

      • memory/2736-33-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2736-80-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2876-71-0x0000000000400000-0x0000000000478000-memory.dmp

        Filesize

        480KB

      • memory/2876-58-0x0000000000400000-0x0000000000478000-memory.dmp

        Filesize

        480KB

      • memory/2876-66-0x0000000000400000-0x0000000000478000-memory.dmp

        Filesize

        480KB

      • memory/2876-61-0x0000000000400000-0x0000000000478000-memory.dmp

        Filesize

        480KB

      • memory/2876-54-0x0000000000400000-0x0000000000478000-memory.dmp

        Filesize

        480KB

      • memory/3020-56-0x0000000000400000-0x0000000000462000-memory.dmp

        Filesize

        392KB

      • memory/3020-59-0x0000000000400000-0x0000000000462000-memory.dmp

        Filesize

        392KB

      • memory/3020-60-0x0000000000400000-0x0000000000462000-memory.dmp

        Filesize

        392KB