Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    180s
  • max time network
    157s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09/10/2024, 22:47

General

  • Target

    LIQUIDACION0002389204324283.exe

  • Size

    5.0MB

  • MD5

    f4f4a22021ac7ec3dbeaca8ecbb06043

  • SHA1

    1bac415e7901b29a10cf3d0bdc90be5822003a81

  • SHA256

    860b0aba6759593740ad1b6b5ae1bb895c09b85be566273c2877ef140ef75a65

  • SHA512

    1c9b01d6e4f1b8b318d42ec10a54552dd2dabac6ea79abc657ddd2efbd5006cb80d2b112725f4dd57a1195eb151bcf5f860cc98f90254c6491f235152be6a742

  • SSDEEP

    98304:3/k9oQgoMllDi8miotam56KNGiomHbJd5ML+waoQLi3nQiIK:3fQgbDDi8miotam56KNh7JIQ2AiL

Malware Config

Extracted

Family

remcos

Botnet

09()()()OcTUBRE()()()2024

C2

oijifhb490398hfuni34uifn4.con-ip.com:5023

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-HZCS32

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\LIQUIDACION0002389204324283.exe
    "C:\Users\Admin\AppData\Local\Temp\LIQUIDACION0002389204324283.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2168
    • C:\Users\Admin\AppData\Local\Temp\LIQUIDACION0002389204324283.exe
      "C:\Users\Admin\AppData\Local\Temp\LIQUIDACION0002389204324283.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3068

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\remcos\logs.dat

    Filesize

    144B

    MD5

    0f8a5c457d9d781c353eb395ac8a0c17

    SHA1

    fbb57ed06250aa2285676d9627ed4b2a56eed5f1

    SHA256

    a7fc344d35f29fb8d1a0f23fa75e38143bac577e8964b095c8be1e134b1164ea

    SHA512

    b0424c1c591361d84bc3f7fb15710b43c3c3ebd33501ac385c2664578281e3dc377447bb77bd636c0fbec7e5018d536ef78bac189330c48349c37aa3fe2cb2ca

  • memory/2168-17-0x0000000000400000-0x0000000000969000-memory.dmp

    Filesize

    5.4MB

  • memory/2168-2-0x0000000000513000-0x000000000052C000-memory.dmp

    Filesize

    100KB

  • memory/2168-1-0x0000000000400000-0x0000000000969000-memory.dmp

    Filesize

    5.4MB

  • memory/2168-6-0x0000000000400000-0x0000000000969000-memory.dmp

    Filesize

    5.4MB

  • memory/2168-4-0x0000000000400000-0x0000000000969000-memory.dmp

    Filesize

    5.4MB

  • memory/2168-5-0x0000000000400000-0x0000000000969000-memory.dmp

    Filesize

    5.4MB

  • memory/2168-7-0x0000000000400000-0x0000000000969000-memory.dmp

    Filesize

    5.4MB

  • memory/2168-13-0x0000000000400000-0x0000000000969000-memory.dmp

    Filesize

    5.4MB

  • memory/2168-28-0x0000000000513000-0x000000000052C000-memory.dmp

    Filesize

    100KB

  • memory/2168-0-0x0000000000400000-0x0000000000969000-memory.dmp

    Filesize

    5.4MB

  • memory/3068-12-0x00000000001C0000-0x0000000000242000-memory.dmp

    Filesize

    520KB

  • memory/3068-16-0x00000000001C0000-0x0000000000242000-memory.dmp

    Filesize

    520KB

  • memory/3068-21-0x00000000001C0000-0x0000000000242000-memory.dmp

    Filesize

    520KB

  • memory/3068-22-0x0000000000400000-0x0000000000969000-memory.dmp

    Filesize

    5.4MB

  • memory/3068-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/3068-23-0x00000000001C0000-0x0000000000242000-memory.dmp

    Filesize

    520KB

  • memory/3068-24-0x00000000001C0000-0x0000000000242000-memory.dmp

    Filesize

    520KB

  • memory/3068-25-0x00000000001C0000-0x0000000000242000-memory.dmp

    Filesize

    520KB

  • memory/3068-26-0x00000000001C0000-0x0000000000242000-memory.dmp

    Filesize

    520KB

  • memory/3068-18-0x00000000001C0000-0x0000000000242000-memory.dmp

    Filesize

    520KB

  • memory/3068-35-0x00000000001C0000-0x0000000000242000-memory.dmp

    Filesize

    520KB

  • memory/3068-36-0x00000000001C0000-0x0000000000242000-memory.dmp

    Filesize

    520KB

  • memory/3068-8-0x00000000001C0000-0x0000000000242000-memory.dmp

    Filesize

    520KB

  • memory/3068-43-0x00000000001C0000-0x0000000000242000-memory.dmp

    Filesize

    520KB

  • memory/3068-51-0x00000000001C0000-0x0000000000242000-memory.dmp

    Filesize

    520KB

  • memory/3068-52-0x00000000001C0000-0x0000000000242000-memory.dmp

    Filesize

    520KB

  • memory/3068-59-0x00000000001C0000-0x0000000000242000-memory.dmp

    Filesize

    520KB

  • memory/3068-60-0x00000000001C0000-0x0000000000242000-memory.dmp

    Filesize

    520KB

  • memory/3068-67-0x00000000001C0000-0x0000000000242000-memory.dmp

    Filesize

    520KB

  • memory/3068-68-0x00000000001C0000-0x0000000000242000-memory.dmp

    Filesize

    520KB