Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/08/2024, 01:46

General

  • Target

    ab4df763c5581670d4163462003abad97e8a309fa976fb0d840f44bdd17db7ba.exe

  • Size

    782KB

  • MD5

    4198250ab9b371a88707e6f5885ad17b

  • SHA1

    19204d4586ff59e83ccc974ddf5471690e47eaf1

  • SHA256

    ab4df763c5581670d4163462003abad97e8a309fa976fb0d840f44bdd17db7ba

  • SHA512

    737e445ea137224269e37e61b776f76db7704333c7f73c4bf7769521f3ca8563ebb30983111ae67eee4c9871b3a688cc9d7a3cfab370f59ebb84b18156408fb8

  • SSDEEP

    12288:4GQBy+G5GCSd1eesm6abgGMwNUVPvHooksN:n5+Eq1yHwkvBN

Malware Config

Extracted

Family

remcos

Botnet

benchao

C2

tochisglobal.ddns.net:6426

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-9R4HLX

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Loads dropped DLL 11 IoCs
  • Drops file in System32 directory 3 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ab4df763c5581670d4163462003abad97e8a309fa976fb0d840f44bdd17db7ba.exe
    "C:\Users\Admin\AppData\Local\Temp\ab4df763c5581670d4163462003abad97e8a309fa976fb0d840f44bdd17db7ba.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:3400
    • C:\Program Files (x86)\windows mail\wab.exe
      "C:\Users\Admin\AppData\Local\Temp\ab4df763c5581670d4163462003abad97e8a309fa976fb0d840f44bdd17db7ba.exe"
      2⤵
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3064

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\remcos\logs.dat

    Filesize

    144B

    MD5

    8df6859c07e3fdf35c837a97710f1ba3

    SHA1

    320376a65b9ac27271ad64f921f84e889c71e80e

    SHA256

    004d75831540ed9cddddd23336a2d0e5077176b95825bc800bad028247cae579

    SHA512

    c0df0ff1f601c3a5fe940d30bbedc1fbe0504da16111a88d4efbc4b6d3a72274cef292f8b8e370f51de754034de09f0545b31acce6bf831dba7c9cf6b4949bd4

  • C:\Users\Admin\AppData\Local\Temp\nsd829F.tmp\LangDLL.dll

    Filesize

    5KB

    MD5

    f1e9eed02db3a822a7ddef0c724e5f1f

    SHA1

    65864992f5b6c79c5efbefb5b1354648a8a86709

    SHA256

    6dff504c6759c418c6635c9b25b8c91d0d9ef7787a3a93610d7670bb563c09df

    SHA512

    c22b64fff76b25cf53231b8636f07b361d95791c4646787ce7beac27ad6a0de88337dcceb25b5196f97c452dda72e2614647f51a8a18cb4d5228a82ed2e0780c

  • C:\Users\Admin\AppData\Local\Temp\nsd829F.tmp\System.dll

    Filesize

    11KB

    MD5

    17ed1c86bd67e78ade4712be48a7d2bd

    SHA1

    1cc9fe86d6d6030b4dae45ecddce5907991c01a0

    SHA256

    bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

    SHA512

    0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

  • C:\Users\Public\Pictures\Milliluxes.lnk

    Filesize

    982B

    MD5

    f88f4bc881d5809f3b5f7984756ebe4d

    SHA1

    c85d6b5bea15b03bca5efc33d8a8792bfe6a97a2

    SHA256

    a69540c307517828056b0c6e100525be34c89aaf95d1b830fb284a5f56177b75

    SHA512

    605f76dfe62b46c8afa820173e833da6538f9a66cd27ff00186b4ebdbbe6eb712afe6e9fbcc7fdb83bc18184774c11b4bcce35695887a61c4a99dbe53d650ebe

  • C:\Windows\SysWOW64\Dogmefastes.lnk

    Filesize

    1KB

    MD5

    7b7b2d4c83bb1706ab50356841652f92

    SHA1

    c109fa49a5f2f82cca0c401fdf397d6de760aee2

    SHA256

    9add9134c7f37a36c21eb31b13461bb8e94700fa94b5828e394d17312e002d06

    SHA512

    9837262faea7c421d457c316443892b7ea424ec70e719886145b1db4ab3797277cc9216718b12231025706ee9f9201b679c913a93f7e73d74de1edf958d4afd3

  • memory/3064-657-0x0000000000B60000-0x0000000001DB4000-memory.dmp

    Filesize

    18.3MB

  • memory/3064-644-0x0000000000B60000-0x0000000001DB4000-memory.dmp

    Filesize

    18.3MB

  • memory/3064-681-0x0000000000B60000-0x0000000001DB4000-memory.dmp

    Filesize

    18.3MB

  • memory/3064-678-0x0000000000B60000-0x0000000001DB4000-memory.dmp

    Filesize

    18.3MB

  • memory/3064-638-0x0000000001DC0000-0x0000000004019000-memory.dmp

    Filesize

    34.3MB

  • memory/3064-639-0x0000000000B60000-0x0000000001DB4000-memory.dmp

    Filesize

    18.3MB

  • memory/3064-675-0x0000000000B60000-0x0000000001DB4000-memory.dmp

    Filesize

    18.3MB

  • memory/3064-666-0x0000000000B60000-0x0000000001DB4000-memory.dmp

    Filesize

    18.3MB

  • memory/3064-645-0x0000000001DC0000-0x0000000004019000-memory.dmp

    Filesize

    34.3MB

  • memory/3064-648-0x0000000000B60000-0x0000000001DB4000-memory.dmp

    Filesize

    18.3MB

  • memory/3064-651-0x0000000000B60000-0x0000000001DB4000-memory.dmp

    Filesize

    18.3MB

  • memory/3064-672-0x0000000000B60000-0x0000000001DB4000-memory.dmp

    Filesize

    18.3MB

  • memory/3064-654-0x0000000000B60000-0x0000000001DB4000-memory.dmp

    Filesize

    18.3MB

  • memory/3064-669-0x0000000000B60000-0x0000000001DB4000-memory.dmp

    Filesize

    18.3MB

  • memory/3064-660-0x0000000000B60000-0x0000000001DB4000-memory.dmp

    Filesize

    18.3MB

  • memory/3064-663-0x0000000000B60000-0x0000000001DB4000-memory.dmp

    Filesize

    18.3MB

  • memory/3400-643-0x0000000005000000-0x0000000007259000-memory.dmp

    Filesize

    34.3MB

  • memory/3400-633-0x0000000005000000-0x0000000007259000-memory.dmp

    Filesize

    34.3MB

  • memory/3400-634-0x0000000005000000-0x0000000007259000-memory.dmp

    Filesize

    34.3MB

  • memory/3400-635-0x00000000775C1000-0x00000000776E1000-memory.dmp

    Filesize

    1.1MB

  • memory/3400-637-0x0000000010004000-0x0000000010005000-memory.dmp

    Filesize

    4KB

  • memory/3400-636-0x00000000775C1000-0x00000000776E1000-memory.dmp

    Filesize

    1.1MB