Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    2e01a38518327e49082e2a07468320a453f1814644763f25c36a78dd6848697a

  • Size

    908KB

  • Sample

    240930-hzev3asalj

  • MD5

    3a0c7c1a0ef79022e4b5eaca676624fa

  • SHA1

    f216db1db77eae9785908dd2ddaa91ace4c33c49

  • SHA256

    2e01a38518327e49082e2a07468320a453f1814644763f25c36a78dd6848697a

  • SHA512

    26e0a7370bbb5740c8a9309495c98688749aed4f181a7389bbb902fcab5d39ccd370e5d44c889ac93cff4901b8436d0258809e64bb762399738f9d5a06b7674a

  • SSDEEP

    24576:zD4y7ucw+kKPjtyiZOoofmKPprfmleOpY2qLVUmqv:/XaEPjtRjDKhrbOpvA9m

Malware Config

Extracted

Family

remcos

Botnet

IRN

C2

irnserv1.ddns.net:4424

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    true

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-CA8761

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      TNT invoice 9.30.2024.exe

    • Size

      1017KB

    • MD5

      673d693b0c8b68503d64ed15fd863d61

    • SHA1

      4fb6b11e933354b9f7c5bda096543a5d6b56ff83

    • SHA256

      a77754ef6de4a61024e443178b88e50be8b1994f87b323ed7fa5f2f197acdab4

    • SHA512

      3996083d6b2f207e742a81a1dd11277c1bdb2631438a0ee72eeec88a57ff39fb2a7c9a100b30bc2839519c3019129d2157e89d6ade8cc326c4073daf4cc2bd27

    • SSDEEP

      24576:myN887MU2cPnNupjbW/5OheoofVmhGmfCtquly:myNVQUPNudihOhRdhHIqul

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks