Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/09/2024, 01:42

General

  • Target

    b4952421150265489acc51c83234643237b1f06e468c450d604210e3ee50316e.exe

  • Size

    991KB

  • MD5

    4839930b3f7915602fd40251b76bb9c5

  • SHA1

    fe3a9de406d44c6a9aa5a6ad1fede58f6a0e413f

  • SHA256

    b4952421150265489acc51c83234643237b1f06e468c450d604210e3ee50316e

  • SHA512

    54b4b3ba92406fb1417eda6366cc4806f10dfae1233cb009c697a8b95f990bd497a7e50140f48406566e16dedf0a62a0f71f25d862d1113a92d6277cacf5016f

  • SSDEEP

    12288:vdZshZWHXnhEE8tpUEx1I94L+R49xIUBZjlP4JH0Y6QC4zmEs0mwF0WOs5HvrWZO:vzshZEXw7jIS6RuXGUDQFDMEKW4THM00

Malware Config

Extracted

Family

remcos

Botnet

Aug 23C

C2

method8888.ddns.net:6902

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-RCNGU6

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Detected Nirsoft tools 3 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView 1 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 1 IoCs

    Password recovery tool for various web browsers

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b4952421150265489acc51c83234643237b1f06e468c450d604210e3ee50316e.exe
    "C:\Users\Admin\AppData\Local\Temp\b4952421150265489acc51c83234643237b1f06e468c450d604210e3ee50316e.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4480
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\b4952421150265489acc51c83234643237b1f06e468c450d604210e3ee50316e.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:8
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TkhOsslQS.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2356
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TkhOsslQS" /XML "C:\Users\Admin\AppData\Local\Temp\tmp393B.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:3012
    • C:\Users\Admin\AppData\Local\Temp\b4952421150265489acc51c83234643237b1f06e468c450d604210e3ee50316e.exe
      "C:\Users\Admin\AppData\Local\Temp\b4952421150265489acc51c83234643237b1f06e468c450d604210e3ee50316e.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:528
      • C:\Users\Admin\AppData\Local\Temp\b4952421150265489acc51c83234643237b1f06e468c450d604210e3ee50316e.exe
        C:\Users\Admin\AppData\Local\Temp\b4952421150265489acc51c83234643237b1f06e468c450d604210e3ee50316e.exe /stext "C:\Users\Admin\AppData\Local\Temp\xenrwrprfzndjoqdhuklgpdh"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1580
      • C:\Users\Admin\AppData\Local\Temp\b4952421150265489acc51c83234643237b1f06e468c450d604210e3ee50316e.exe
        C:\Users\Admin\AppData\Local\Temp\b4952421150265489acc51c83234643237b1f06e468c450d604210e3ee50316e.exe /stext "C:\Users\Admin\AppData\Local\Temp\igsjxkzlthfqudmhqfxmrbxydur"
        3⤵
          PID:3260
        • C:\Users\Admin\AppData\Local\Temp\b4952421150265489acc51c83234643237b1f06e468c450d604210e3ee50316e.exe
          C:\Users\Admin\AppData\Local\Temp\b4952421150265489acc51c83234643237b1f06e468c450d604210e3ee50316e.exe /stext "C:\Users\Admin\AppData\Local\Temp\igsjxkzlthfqudmhqfxmrbxydur"
          3⤵
            PID:876
          • C:\Users\Admin\AppData\Local\Temp\b4952421150265489acc51c83234643237b1f06e468c450d604210e3ee50316e.exe
            C:\Users\Admin\AppData\Local\Temp\b4952421150265489acc51c83234643237b1f06e468c450d604210e3ee50316e.exe /stext "C:\Users\Admin\AppData\Local\Temp\igsjxkzlthfqudmhqfxmrbxydur"
            3⤵
            • Accesses Microsoft Outlook accounts
            • System Location Discovery: System Language Discovery
            PID:4920
          • C:\Users\Admin\AppData\Local\Temp\b4952421150265489acc51c83234643237b1f06e468c450d604210e3ee50316e.exe
            C:\Users\Admin\AppData\Local\Temp\b4952421150265489acc51c83234643237b1f06e468c450d604210e3ee50316e.exe /stext "C:\Users\Admin\AppData\Local\Temp\kagcyukmhpxvwjalhpjgugspebbdznf"
            3⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4360

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\remcos\logs.dat

        Filesize

        144B

        MD5

        67da6f9d47e7af479ef0b5377edeec02

        SHA1

        205a2a8d1725a7cd47ec4d8a1591d8b50dbade46

        SHA256

        086331ffd3d86b1755cf846f994472263e7d2c80605f8dfc5797784dad690723

        SHA512

        affc0a7ea0a4d1d13e554318b875c6e41cfc23a5ce0674222a83ef31e4a81fbf245923da982bc28cdba19e8bdb8b4a839704c171bd164f409a9ea4c7acf78406

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

        Filesize

        2KB

        MD5

        968cb9309758126772781b83adb8a28f

        SHA1

        8da30e71accf186b2ba11da1797cf67f8f78b47c

        SHA256

        92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

        SHA512

        4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        18KB

        MD5

        7048dc3c106fab0a6232cccafeb1c136

        SHA1

        c476e9784c99b9be4bf8d2a1acf07d3387c2b391

        SHA256

        e3a2b325b030d9ff69780fed4a8b63c44753d4958351bac0dab357ad583ee1fa

        SHA512

        1bcd2d2832a69f20896ef4a51aa6fda103eaa5d9ae30777fa9a4fc2139c79f3bbd50756493f60179abaffd99fead4b9c832339a51e6a0a7e0c08fb66b4dbd79a

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fpdevza1.zaj.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Users\Admin\AppData\Local\Temp\tmp393B.tmp

        Filesize

        1KB

        MD5

        a712d59d31668e7dee805a690fd2ee49

        SHA1

        9f62ac84a973c5607b39a97e9d3b7f697b5f1703

        SHA256

        1680d572ac6f742eb9dc3a80962b0b25950fb7ac41c6e03f01ee2b0415e51f65

        SHA512

        f9b39223661208934f21f41a268ad4a12054e03fc2aea974aa27c27ccdf043725e0d9c808d6d64c212de95c299163ba98f417d40d894ed37f01afbc6e4f65e50

      • C:\Users\Admin\AppData\Local\Temp\xenrwrprfzndjoqdhuklgpdh

        Filesize

        4KB

        MD5

        18db1829b27eaeed163c211f5d179d72

        SHA1

        4442332494cba1e012f8876ecac42126ba995bc6

        SHA256

        610c5ee3f0e63441521d26bc477c9618a4c5f86e93d31b31890680c69e3ecc3d

        SHA512

        123d68b2c84f7a52d15faa212c06f33b04a55585e2aeb16bb14df95b18c0bcf31933e5bf0c736c90bc054b9527fccb046540d3302a0f149ebeed7c6bcca0b986

      • memory/8-115-0x0000000007E10000-0x0000000007E24000-memory.dmp

        Filesize

        80KB

      • memory/8-114-0x0000000007E00000-0x0000000007E0E000-memory.dmp

        Filesize

        56KB

      • memory/8-116-0x0000000007F10000-0x0000000007F2A000-memory.dmp

        Filesize

        104KB

      • memory/8-104-0x0000000007C40000-0x0000000007C4A000-memory.dmp

        Filesize

        40KB

      • memory/8-103-0x0000000007BD0000-0x0000000007BEA000-memory.dmp

        Filesize

        104KB

      • memory/8-81-0x0000000075190000-0x00000000751DC000-memory.dmp

        Filesize

        304KB

      • memory/8-38-0x0000000006320000-0x0000000006674000-memory.dmp

        Filesize

        3.3MB

      • memory/8-55-0x0000000074900000-0x00000000750B0000-memory.dmp

        Filesize

        7.7MB

      • memory/8-18-0x0000000002F90000-0x0000000002FC6000-memory.dmp

        Filesize

        216KB

      • memory/8-19-0x0000000074900000-0x00000000750B0000-memory.dmp

        Filesize

        7.7MB

      • memory/8-124-0x0000000074900000-0x00000000750B0000-memory.dmp

        Filesize

        7.7MB

      • memory/8-21-0x0000000074900000-0x00000000750B0000-memory.dmp

        Filesize

        7.7MB

      • memory/528-112-0x0000000010000000-0x0000000010019000-memory.dmp

        Filesize

        100KB

      • memory/528-47-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/528-147-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/528-146-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/528-139-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/528-41-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/528-45-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/528-50-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/528-138-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/528-56-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/528-131-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/528-65-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/528-130-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/528-113-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/528-108-0x0000000010000000-0x0000000010019000-memory.dmp

        Filesize

        100KB

      • memory/528-111-0x0000000010000000-0x0000000010019000-memory.dmp

        Filesize

        100KB

      • memory/528-63-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/528-62-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/528-60-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/528-61-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/1580-67-0x0000000000400000-0x0000000000478000-memory.dmp

        Filesize

        480KB

      • memory/1580-66-0x0000000000400000-0x0000000000478000-memory.dmp

        Filesize

        480KB

      • memory/1580-68-0x0000000000400000-0x0000000000478000-memory.dmp

        Filesize

        480KB

      • memory/2356-78-0x0000000006D30000-0x0000000006D62000-memory.dmp

        Filesize

        200KB

      • memory/2356-59-0x0000000005E30000-0x0000000005E7C000-memory.dmp

        Filesize

        304KB

      • memory/2356-24-0x00000000054A0000-0x00000000054C2000-memory.dmp

        Filesize

        136KB

      • memory/2356-26-0x00000000055B0000-0x0000000005616000-memory.dmp

        Filesize

        408KB

      • memory/2356-20-0x0000000004E40000-0x0000000005468000-memory.dmp

        Filesize

        6.2MB

      • memory/2356-79-0x0000000075190000-0x00000000751DC000-memory.dmp

        Filesize

        304KB

      • memory/2356-39-0x0000000074900000-0x00000000750B0000-memory.dmp

        Filesize

        7.7MB

      • memory/2356-23-0x0000000074900000-0x00000000750B0000-memory.dmp

        Filesize

        7.7MB

      • memory/2356-123-0x0000000074900000-0x00000000750B0000-memory.dmp

        Filesize

        7.7MB

      • memory/2356-117-0x00000000073E0000-0x00000000073E8000-memory.dmp

        Filesize

        32KB

      • memory/2356-25-0x0000000005540000-0x00000000055A6000-memory.dmp

        Filesize

        408KB

      • memory/2356-32-0x0000000074900000-0x00000000750B0000-memory.dmp

        Filesize

        7.7MB

      • memory/2356-90-0x0000000006D10000-0x0000000006D2E000-memory.dmp

        Filesize

        120KB

      • memory/2356-101-0x0000000006D70000-0x0000000006E13000-memory.dmp

        Filesize

        652KB

      • memory/2356-58-0x0000000005DA0000-0x0000000005DBE000-memory.dmp

        Filesize

        120KB

      • memory/2356-102-0x0000000007700000-0x0000000007D7A000-memory.dmp

        Filesize

        6.5MB

      • memory/2356-106-0x00000000072C0000-0x00000000072D1000-memory.dmp

        Filesize

        68KB

      • memory/2356-105-0x0000000007340000-0x00000000073D6000-memory.dmp

        Filesize

        600KB

      • memory/4360-76-0x0000000000400000-0x0000000000424000-memory.dmp

        Filesize

        144KB

      • memory/4360-75-0x0000000000400000-0x0000000000424000-memory.dmp

        Filesize

        144KB

      • memory/4360-77-0x0000000000400000-0x0000000000424000-memory.dmp

        Filesize

        144KB

      • memory/4480-4-0x0000000074900000-0x00000000750B0000-memory.dmp

        Filesize

        7.7MB

      • memory/4480-13-0x0000000006E80000-0x0000000006F40000-memory.dmp

        Filesize

        768KB

      • memory/4480-12-0x0000000006E20000-0x0000000006E30000-memory.dmp

        Filesize

        64KB

      • memory/4480-7-0x00000000072E0000-0x00000000073C8000-memory.dmp

        Filesize

        928KB

      • memory/4480-6-0x0000000005D60000-0x0000000005DFC000-memory.dmp

        Filesize

        624KB

      • memory/4480-5-0x0000000005C60000-0x0000000005C6A000-memory.dmp

        Filesize

        40KB

      • memory/4480-0-0x000000007490E000-0x000000007490F000-memory.dmp

        Filesize

        4KB

      • memory/4480-9-0x000000007490E000-0x000000007490F000-memory.dmp

        Filesize

        4KB

      • memory/4480-3-0x0000000005AD0000-0x0000000005B62000-memory.dmp

        Filesize

        584KB

      • memory/4480-10-0x0000000074900000-0x00000000750B0000-memory.dmp

        Filesize

        7.7MB

      • memory/4480-2-0x0000000006080000-0x0000000006624000-memory.dmp

        Filesize

        5.6MB

      • memory/4480-1-0x0000000000FC0000-0x00000000010BA000-memory.dmp

        Filesize

        1000KB

      • memory/4480-11-0x0000000006E10000-0x0000000006E1C000-memory.dmp

        Filesize

        48KB

      • memory/4480-8-0x00000000073F0000-0x000000000740A000-memory.dmp

        Filesize

        104KB

      • memory/4480-57-0x0000000074900000-0x00000000750B0000-memory.dmp

        Filesize

        7.7MB

      • memory/4920-71-0x0000000000400000-0x0000000000462000-memory.dmp

        Filesize

        392KB

      • memory/4920-70-0x0000000000400000-0x0000000000462000-memory.dmp

        Filesize

        392KB

      • memory/4920-69-0x0000000000400000-0x0000000000462000-memory.dmp

        Filesize

        392KB