Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/09/2024, 15:34 UTC

General

  • Target

    Quotationpdf.exe

  • Size

    869KB

  • MD5

    27934061e8cbcfcf5e5b8937a662c26f

  • SHA1

    a508513b842e11c7c277af67e4bc51466d0637b8

  • SHA256

    49e7ee12a475105efab2e363450b2e5582fc05d114967fe57a3d80d22a2fea81

  • SHA512

    c79374546867ae8197d6fdbec40150b7124e272151e73c2a7361dd96a04b3a5f710d42f82b0d77349a07ae667aee066b11c949782eb2f2329e3711752e2c95d2

  • SSDEEP

    24576:q0jXiRZoEJGywbvjCe9WRSKObmSej7vydBs:MDIvjCe4ebmSejzf

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

127.0.0.1:59321

nnamoo.duckdns.org:59321

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-41EVS0

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Quotationpdf.exe
    "C:\Users\Admin\AppData\Local\Temp\Quotationpdf.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4612
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Quotationpdf.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:216
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\BptXqGmS.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4716
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BptXqGmS" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEAEC.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:4044
    • C:\Users\Admin\AppData\Local\Temp\Quotationpdf.exe
      "C:\Users\Admin\AppData\Local\Temp\Quotationpdf.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2236

Network

  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    42.56.20.217.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    42.56.20.217.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    28.118.140.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    28.118.140.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    23.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    23.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    209.205.72.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    209.205.72.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    nnamoo.duckdns.org
    Quotationpdf.exe
    Remote address:
    8.8.8.8:53
    Request
    nnamoo.duckdns.org
    IN A
    Response
    nnamoo.duckdns.org
    IN A
    103.186.117.126
  • flag-us
    DNS
    nnamoo.duckdns.org
    Quotationpdf.exe
    Remote address:
    8.8.8.8:53
    Request
    nnamoo.duckdns.org
    IN A
    Response
  • flag-us
    DNS
    nnamoo.duckdns.org
    Quotationpdf.exe
    Remote address:
    8.8.8.8:53
    Request
    nnamoo.duckdns.org
    IN A
    Response
  • flag-us
    DNS
    126.117.186.103.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    126.117.186.103.in-addr.arpa
    IN PTR
    Response
    126.117.186.103.in-addr.arpa
    IN PTR
    wixcom
  • flag-us
    DNS
    geoplugin.net
    Quotationpdf.exe
    Remote address:
    8.8.8.8:53
    Request
    geoplugin.net
    IN A
    Response
    geoplugin.net
    IN A
    178.237.33.50
  • flag-nl
    GET
    http://geoplugin.net/json.gp
    Quotationpdf.exe
    Remote address:
    178.237.33.50:80
    Request
    GET /json.gp HTTP/1.1
    Host: geoplugin.net
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    date: Fri, 20 Sep 2024 15:34:58 GMT
    server: Apache
    content-length: 955
    content-type: application/json; charset=utf-8
    cache-control: public, max-age=300
    access-control-allow-origin: *
  • flag-us
    DNS
    50.33.237.178.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    50.33.237.178.in-addr.arpa
    IN PTR
    Response
    50.33.237.178.in-addr.arpa
    IN CNAME
    50.32/27.178.237.178.in-addr.arpa
  • flag-us
    DNS
    183.59.114.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    183.59.114.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    171.39.242.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    171.39.242.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    45.56.20.217.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    45.56.20.217.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    240.143.123.92.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    240.143.123.92.in-addr.arpa
    IN PTR
    Response
    240.143.123.92.in-addr.arpa
    IN PTR
    a92-123-143-240deploystaticakamaitechnologiescom
  • 127.0.0.1:59321
    Quotationpdf.exe
  • 103.186.117.126:59321
    nnamoo.duckdns.org
    tls
    Quotationpdf.exe
    3.2kB
    1.5kB
    13
    16
  • 178.237.33.50:80
    http://geoplugin.net/json.gp
    http
    Quotationpdf.exe
    577 B
    1.3kB
    11
    3

    HTTP Request

    GET http://geoplugin.net/json.gp

    HTTP Response

    200
  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
    90 B
    1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    42.56.20.217.in-addr.arpa
    dns
    71 B
    131 B
    1
    1

    DNS Request

    42.56.20.217.in-addr.arpa

  • 8.8.8.8:53
    28.118.140.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    28.118.140.52.in-addr.arpa

  • 8.8.8.8:53
    23.159.190.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    23.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    209.205.72.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    209.205.72.20.in-addr.arpa

  • 8.8.8.8:53
    nnamoo.duckdns.org
    dns
    Quotationpdf.exe
    192 B
    208 B
    3
    3

    DNS Request

    nnamoo.duckdns.org

    DNS Request

    nnamoo.duckdns.org

    DNS Request

    nnamoo.duckdns.org

    DNS Response

    103.186.117.126

  • 8.8.8.8:53
    126.117.186.103.in-addr.arpa
    dns
    74 B
    95 B
    1
    1

    DNS Request

    126.117.186.103.in-addr.arpa

  • 8.8.8.8:53
    geoplugin.net
    dns
    Quotationpdf.exe
    59 B
    75 B
    1
    1

    DNS Request

    geoplugin.net

    DNS Response

    178.237.33.50

  • 8.8.8.8:53
    50.33.237.178.in-addr.arpa
    dns
    72 B
    155 B
    1
    1

    DNS Request

    50.33.237.178.in-addr.arpa

  • 8.8.8.8:53
    171.39.242.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    171.39.242.20.in-addr.arpa

  • 8.8.8.8:53
    183.59.114.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    183.59.114.20.in-addr.arpa

  • 8.8.8.8:53
    45.56.20.217.in-addr.arpa
    dns
    71 B
    131 B
    1
    1

    DNS Request

    45.56.20.217.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
    128 B
    1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    240.143.123.92.in-addr.arpa
    dns
    73 B
    139 B
    1
    1

    DNS Request

    240.143.123.92.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    968cb9309758126772781b83adb8a28f

    SHA1

    8da30e71accf186b2ba11da1797cf67f8f78b47c

    SHA256

    92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

    SHA512

    4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    9a81986f8f0e62295c157cbb37515324

    SHA1

    b757a940f12ae361873212c186e92d9c396c11ba

    SHA256

    38c1cedca0ecf71fe9c23122b10d639beb1f6d93bee53073aefb3800a40019ee

    SHA512

    25433fc8d26fa8efc12be3fb02694c90de33a17e77acbdd1606e57bb95714b83d1891949322f892b69b137d620f70381551a860231eb8c2fc2545484d880ddd3

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nl5zcwlx.axa.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\tmpEAEC.tmp

    Filesize

    1KB

    MD5

    bd77bd270afb34fa4e1f25ef2917bcae

    SHA1

    844c9de75981b9dba3bd5fc879afd6fad83b3a56

    SHA256

    bac59494025b8ebdade72307fb639bfff7e63b865c40e64f55ea92949b754093

    SHA512

    7f8658098bdb43cd2d6149d585d99e3becc3a0a1158a2edbabd82a07752dbaf07c77d96fece2de3396425a4e55631ca2b00549a3925be07bf5ce5bc99254e381

  • memory/216-19-0x00000000750D0000-0x0000000075880000-memory.dmp

    Filesize

    7.7MB

  • memory/216-22-0x0000000005310000-0x0000000005376000-memory.dmp

    Filesize

    408KB

  • memory/216-82-0x0000000007040000-0x0000000007051000-memory.dmp

    Filesize

    68KB

  • memory/216-76-0x0000000006B00000-0x0000000006BA3000-memory.dmp

    Filesize

    652KB

  • memory/216-93-0x00000000750D0000-0x0000000075880000-memory.dmp

    Filesize

    7.7MB

  • memory/216-83-0x0000000007070000-0x000000000707E000-memory.dmp

    Filesize

    56KB

  • memory/216-56-0x0000000075980000-0x00000000759CC000-memory.dmp

    Filesize

    304KB

  • memory/216-15-0x0000000004560000-0x0000000004596000-memory.dmp

    Filesize

    216KB

  • memory/216-16-0x00000000750D0000-0x0000000075880000-memory.dmp

    Filesize

    7.7MB

  • memory/216-17-0x0000000004C10000-0x0000000005238000-memory.dmp

    Filesize

    6.2MB

  • memory/216-18-0x00000000750D0000-0x0000000075880000-memory.dmp

    Filesize

    7.7MB

  • memory/216-53-0x0000000005BB0000-0x0000000005BFC000-memory.dmp

    Filesize

    304KB

  • memory/216-52-0x0000000005AF0000-0x0000000005B0E000-memory.dmp

    Filesize

    120KB

  • memory/216-21-0x0000000005270000-0x0000000005292000-memory.dmp

    Filesize

    136KB

  • memory/216-23-0x0000000005380000-0x00000000053E6000-memory.dmp

    Filesize

    408KB

  • memory/216-80-0x00000000070C0000-0x0000000007156000-memory.dmp

    Filesize

    600KB

  • memory/2236-44-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2236-94-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2236-100-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2236-96-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2236-43-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2236-49-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2236-95-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2236-48-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2236-99-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2236-97-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2236-101-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2236-102-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2236-103-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2236-104-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2236-105-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2236-106-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2236-107-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2236-81-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/4612-5-0x0000000004CF0000-0x0000000004CFA000-memory.dmp

    Filesize

    40KB

  • memory/4612-51-0x00000000750D0000-0x0000000075880000-memory.dmp

    Filesize

    7.7MB

  • memory/4612-6-0x0000000004E60000-0x0000000004E70000-memory.dmp

    Filesize

    64KB

  • memory/4612-7-0x00000000750DE000-0x00000000750DF000-memory.dmp

    Filesize

    4KB

  • memory/4612-9-0x00000000068C0000-0x000000000697E000-memory.dmp

    Filesize

    760KB

  • memory/4612-10-0x0000000008F40000-0x0000000008FDC000-memory.dmp

    Filesize

    624KB

  • memory/4612-0-0x00000000750DE000-0x00000000750DF000-memory.dmp

    Filesize

    4KB

  • memory/4612-4-0x00000000750D0000-0x0000000075880000-memory.dmp

    Filesize

    7.7MB

  • memory/4612-3-0x0000000004D10000-0x0000000004DA2000-memory.dmp

    Filesize

    584KB

  • memory/4612-2-0x00000000051E0000-0x0000000005784000-memory.dmp

    Filesize

    5.6MB

  • memory/4612-1-0x0000000000230000-0x0000000000310000-memory.dmp

    Filesize

    896KB

  • memory/4612-8-0x00000000750D0000-0x0000000075880000-memory.dmp

    Filesize

    7.7MB

  • memory/4716-85-0x00000000078F0000-0x000000000790A000-memory.dmp

    Filesize

    104KB

  • memory/4716-79-0x0000000007630000-0x000000000763A000-memory.dmp

    Filesize

    40KB

  • memory/4716-92-0x00000000750D0000-0x0000000075880000-memory.dmp

    Filesize

    7.7MB

  • memory/4716-40-0x0000000005CE0000-0x0000000006034000-memory.dmp

    Filesize

    3.3MB

  • memory/4716-86-0x00000000078D0000-0x00000000078D8000-memory.dmp

    Filesize

    32KB

  • memory/4716-25-0x00000000750D0000-0x0000000075880000-memory.dmp

    Filesize

    7.7MB

  • memory/4716-24-0x00000000750D0000-0x0000000075880000-memory.dmp

    Filesize

    7.7MB

  • memory/4716-42-0x00000000750D0000-0x0000000075880000-memory.dmp

    Filesize

    7.7MB

  • memory/4716-84-0x00000000077F0000-0x0000000007804000-memory.dmp

    Filesize

    80KB

  • memory/4716-74-0x0000000007200000-0x000000000721E000-memory.dmp

    Filesize

    120KB

  • memory/4716-54-0x0000000007220000-0x0000000007252000-memory.dmp

    Filesize

    200KB

  • memory/4716-55-0x0000000075980000-0x00000000759CC000-memory.dmp

    Filesize

    304KB

  • memory/4716-77-0x0000000007C00000-0x000000000827A000-memory.dmp

    Filesize

    6.5MB

  • memory/4716-78-0x00000000075B0000-0x00000000075CA000-memory.dmp

    Filesize

    104KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.