Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

Portafolio...24.exe

windows7-x64

10

Portafolio...24.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/10/2024, 23:33 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Portafolio Digital de Transacción Electronica 0002938248924.exe

  • Size

    4.5MB

  • MD5

    13533b986d24ba176e64c6e7f8baa0a0

  • SHA1

    20b1526c6df49a5b7b6eb3f456a8f29f011f9c6f

  • SHA256

    33dae786b8b7debb0443f3ffd7922a3366072c0f3cb8c5a14cb6168938f0eecf

  • SHA512

    5896593d110faa753e262e6f357d6767c3c9ce378c61d2c7db15cf0f720b79a7e54b940fb12fa5bb2e5421a64b94534dee68b0b16e3a6465f3532aea42b8d4be

  • SSDEEP

    49152:QyVdmxB5GSL4m35GyJZYMrbcDifMb2TaIsjE1zSOmFaTXgaFInzHpGdk5KySXINi:QybbOGyJZYMrb7fMb2nZhdQWCMfj

Score
10/10
remcosoctudiscoverypersistencerat

Malware Config

Extracted

Family

remcos

Botnet

OCTU

C2

segurosbolivar24.con-ip.com:2006

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    registros.dat

  • keylog_flag

    false

  • keylog_folder

    regist

  • mouse_option

    false

  • mutex

    ljnghvfghujkvgnasftnz-X8YJ1F

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Capturas de pantalla

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Portafolio Digital de Transacción Electronica 0002938248924.exe
    "C:\Users\Admin\AppData\Local\Temp\Portafolio Digital de Transacción Electronica 0002938248924.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:976
    • C:\Users\Admin\AppData\Local\Temp\Portafolio Digital de Transacción Electronica 0002938248924.exe
      "C:\Users\Admin\AppData\Local\Temp\Portafolio Digital de Transacción Electronica 0002938248924.exe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4488
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fsonpzkif.vbs"
        3⤵
        • Deletes itself
        • System Location Discovery: System Language Discovery
        PID:3888

Network

  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
    Response
    g.bing.com
    IN CNAME
    g-bing-com.ax-0001.ax-msedge.net
    g-bing-com.ax-0001.ax-msedge.net
    IN CNAME
    ax-0001.ax-msedge.net
    ax-0001.ax-msedge.net
    IN A
    150.171.28.10
    ax-0001.ax-msedge.net
    IN A
    150.171.27.10
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=12c6685a849a476b9da7c49b57b34be9&localId=w:45F2691B-218C-F38E-DD34-9B67AA44BEAA&deviceId=6825841072482335&anid=
    Remote address:
    150.171.28.10:443
    Request
    GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=12c6685a849a476b9da7c49b57b34be9&localId=w:45F2691B-218C-F38E-DD34-9B67AA44BEAA&deviceId=6825841072482335&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MUID=3BB0130994A06AFC32B9061B95626B62; domain=.bing.com; expires=Sun, 02-Nov-2025 23:33:46 GMT; path=/; SameSite=None; Secure; Priority=High;
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 7F285C03149D431BBF2D07E585F1DADD Ref B: LON601060105011 Ref C: 2024-10-08T23:33:46Z
    date: Tue, 08 Oct 2024 23:33:46 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=12c6685a849a476b9da7c49b57b34be9&localId=w:45F2691B-218C-F38E-DD34-9B67AA44BEAA&deviceId=6825841072482335&anid=
    Remote address:
    150.171.28.10:443
    Request
    GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=12c6685a849a476b9da7c49b57b34be9&localId=w:45F2691B-218C-F38E-DD34-9B67AA44BEAA&deviceId=6825841072482335&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=3BB0130994A06AFC32B9061B95626B62
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MSPTC=1c0Kz7sAC-5YjbdL2pJmwbYlXIs67LfXrXv5xfgcn3I; domain=.bing.com; expires=Sun, 02-Nov-2025 23:33:46 GMT; path=/; Partitioned; secure; SameSite=None
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 778FF92EE5EF43E3A78F2579E1544E8F Ref B: LON601060105011 Ref C: 2024-10-08T23:33:46Z
    date: Tue, 08 Oct 2024 23:33:46 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=12c6685a849a476b9da7c49b57b34be9&localId=w:45F2691B-218C-F38E-DD34-9B67AA44BEAA&deviceId=6825841072482335&anid=
    Remote address:
    150.171.28.10:443
    Request
    GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=12c6685a849a476b9da7c49b57b34be9&localId=w:45F2691B-218C-F38E-DD34-9B67AA44BEAA&deviceId=6825841072482335&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=3BB0130994A06AFC32B9061B95626B62; MSPTC=1c0Kz7sAC-5YjbdL2pJmwbYlXIs67LfXrXv5xfgcn3I
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 5FAC3C90624A49BD9055BB8A14BCDC5A Ref B: LON601060105011 Ref C: 2024-10-08T23:33:46Z
    date: Tue, 08 Oct 2024 23:33:46 GMT
  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    0.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    0.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    10.28.171.150.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    10.28.171.150.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    57.169.31.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    57.169.31.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    segurosbolivar24.con-ip.com
    Portafolio Digital de Transacción Electronica 0002938248924.exe
    Remote address:
    8.8.8.8:53
    Request
    segurosbolivar24.con-ip.com
    IN A
    Response
    segurosbolivar24.con-ip.com
    IN A
    181.141.41.0
  • flag-us
    DNS
    geoplugin.net
    Portafolio Digital de Transacción Electronica 0002938248924.exe
    Remote address:
    8.8.8.8:53
    Request
    geoplugin.net
    IN A
    Response
    geoplugin.net
    IN A
    178.237.33.50
  • flag-us
    DNS
    0.41.141.181.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    0.41.141.181.in-addr.arpa
    IN PTR
    Response
    0.41.141.181.in-addr.arpa
    IN PTR
    hfc-181-141-41-0unenetco
  • flag-nl
    GET
    http://geoplugin.net/json.gp
    Portafolio Digital de Transacción Electronica 0002938248924.exe
    Remote address:
    178.237.33.50:80
    Request
    GET /json.gp HTTP/1.1
    Host: geoplugin.net
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    date: Tue, 08 Oct 2024 23:33:58 GMT
    server: Apache
    content-length: 955
    content-type: application/json; charset=utf-8
    cache-control: public, max-age=300
    access-control-allow-origin: *
  • flag-us
    DNS
    50.33.237.178.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    50.33.237.178.in-addr.arpa
    IN PTR
    Response
    50.33.237.178.in-addr.arpa
    IN CNAME
    50.32/27.178.237.178.in-addr.arpa
  • flag-us
    DNS
    53.210.109.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    53.210.109.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    206.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    200.163.202.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.163.202.172.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    139.190.18.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    139.190.18.2.in-addr.arpa
    IN PTR
    Response
    139.190.18.2.in-addr.arpa
    IN PTR
    a2-18-190-139deploystaticakamaitechnologiescom
  • flag-us
    DNS
    19.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    19.229.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    131.72.42.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    131.72.42.20.in-addr.arpa
    IN PTR
    Response
  • 150.171.28.10:443
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=12c6685a849a476b9da7c49b57b34be9&localId=w:45F2691B-218C-F38E-DD34-9B67AA44BEAA&deviceId=6825841072482335&anid=
    tls, http2
    2.0kB
     9.3kB
     21
    18

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=12c6685a849a476b9da7c49b57b34be9&localId=w:45F2691B-218C-F38E-DD34-9B67AA44BEAA&deviceId=6825841072482335&anid=

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=12c6685a849a476b9da7c49b57b34be9&localId=w:45F2691B-218C-F38E-DD34-9B67AA44BEAA&deviceId=6825841072482335&anid=

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=12c6685a849a476b9da7c49b57b34be9&localId=w:45F2691B-218C-F38E-DD34-9B67AA44BEAA&deviceId=6825841072482335&anid=

    HTTP Response

    204
  • 181.141.41.0:2006
    segurosbolivar24.con-ip.com
    Portafolio Digital de Transacción Electronica 0002938248924.exe
    2.2kB
     256 B
     8
    5
  • 178.237.33.50:80
    http://geoplugin.net/json.gp
    http
    Portafolio Digital de Transacción Electronica 0002938248924.exe
    347 B
     1.3kB
     6
    3

    HTTP Request

    GET http://geoplugin.net/json.gp

    HTTP Response

    200
  • 8.8.8.8:53
    g.bing.com
    dns
    56 B
     148 B
     1
    1

    DNS Request

    g.bing.com

    DNS Response

    150.171.28.10
    150.171.27.10

  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
     90 B
     1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    0.159.190.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    0.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    10.28.171.150.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    10.28.171.150.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    57.169.31.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    57.169.31.20.in-addr.arpa

  • 8.8.8.8:53
    segurosbolivar24.con-ip.com
    dns
    Portafolio Digital de Transacción Electronica 0002938248924.exe
    73 B
     89 B
     1
    1

    DNS Request

    segurosbolivar24.con-ip.com

    DNS Response

    181.141.41.0

  • 8.8.8.8:53
    geoplugin.net
    dns
    Portafolio Digital de Transacción Electronica 0002938248924.exe
    59 B
     75 B
     1
    1

    DNS Request

    geoplugin.net

    DNS Response

    178.237.33.50

  • 8.8.8.8:53
    0.41.141.181.in-addr.arpa
    dns
    71 B
     112 B
     1
    1

    DNS Request

    0.41.141.181.in-addr.arpa

  • 8.8.8.8:53
    50.33.237.178.in-addr.arpa
    dns
    72 B
     155 B
     1
    1

    DNS Request

    50.33.237.178.in-addr.arpa

  • 8.8.8.8:53
    53.210.109.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    53.210.109.20.in-addr.arpa

  • 8.8.8.8:53
    206.23.85.13.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    206.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    200.163.202.172.in-addr.arpa
    dns
    74 B
     160 B
     1
    1

    DNS Request

    200.163.202.172.in-addr.arpa

  • 8.8.8.8:53
    139.190.18.2.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    139.190.18.2.in-addr.arpa

  • 8.8.8.8:53
    19.229.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    19.229.111.52.in-addr.arpa

  • 8.8.8.8:53
    131.72.42.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    131.72.42.20.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\fsonpzkif.vbs
    Filesize

    708B

    MD5

    35b74931e98c13c89b99d62e46c9048d

    SHA1

    3385c7c35d3915ae66c8f053313d2e3919c5a7c1

    SHA256

    62a93830c48cf82943e42a088c584ba84abaf1a6bc550073c2d1085b531dfffb

    SHA512

    5c9ce5d7a59683e4e8d2a3277e7c0be2ba17ecdf1bdcd186356f612e86b0cb5ccd0d9fcecaf0c9f67e700c83b7be2052581c775ac0ebcd9a13647b45c10c8854

    Download Submit

  • memory/976-0-0x0000000000400000-0x00000000008D2000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/976-1-0x0000000000400000-0x00000000008D2000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/976-5-0x0000000000400000-0x00000000008D2000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/976-7-0x0000000000400000-0x00000000008D2000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/976-9-0x0000000000400000-0x00000000008D2000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/976-6-0x0000000000400000-0x00000000008D2000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/976-2-0x0000000000619000-0x0000000000631000-memory.dmp

    Filesize

    96KB

    Download

  • memory/976-27-0x0000000000619000-0x0000000000631000-memory.dmp

    Filesize

    96KB

    Download

  • memory/976-3-0x0000000000400000-0x00000000008D2000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/976-12-0x0000000000400000-0x00000000008D2000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/976-4-0x0000000000400000-0x00000000008D2000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/976-11-0x0000000000400000-0x00000000008D2000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/4488-14-0x00000000008E0000-0x0000000000962000-memory.dmp

    Filesize

    520KB

    Download

  • memory/4488-8-0x00000000008E0000-0x0000000000962000-memory.dmp

    Filesize

    520KB

    Download

  • memory/4488-19-0x00000000008E0000-0x0000000000962000-memory.dmp

    Filesize

    520KB

    Download

  • memory/4488-15-0x00000000008E0000-0x0000000000962000-memory.dmp

    Filesize

    520KB

    Download

  • memory/4488-20-0x00000000008E0000-0x0000000000962000-memory.dmp

    Filesize

    520KB

    Download

  • memory/4488-21-0x00000000008E0000-0x0000000000962000-memory.dmp

    Filesize

    520KB

    Download

  • memory/4488-22-0x00000000008E0000-0x0000000000962000-memory.dmp

    Filesize

    520KB

    Download

  • memory/4488-23-0x0000000000400000-0x00000000008D2000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/4488-25-0x00000000008E0000-0x0000000000962000-memory.dmp

    Filesize

    520KB

    Download

  • memory/4488-18-0x00000000008E0000-0x0000000000962000-memory.dmp

    Filesize

    520KB

    Download

  • memory/4488-31-0x00000000008E0000-0x0000000000962000-memory.dmp

    Filesize

    520KB

    Download

  • memory/4488-36-0x00000000008E0000-0x0000000000962000-memory.dmp

    Filesize

    520KB

    Download

  • memory/4488-13-0x00000000008E0000-0x0000000000962000-memory.dmp

    Filesize

    520KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.