Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20/11/2024, 10:41

General

  • Target

    QD0FZ_stub.exe

  • Size

    469KB

  • MD5

    e7be6cad5e537ccd392c2a1aefa60ee7

  • SHA1

    324b9688a5d8c39f5e96e41f451cfc9a225d48d2

  • SHA256

    8c7a4657ea68a69f364c8acb1881aa6e0f8140d3aba9a917f484ba6ec705db21

  • SHA512

    0fc526f228ace907e580433d7e85e170ebfdc1eae24cf21d2e35568007f30abf517de2c215b1718ed31787e0ebfdafd89f11e6214f09f01492f75fe209c09037

  • SSDEEP

    12288:Wmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQS0n9:uiLJbpI7I2WhQqZ709

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

else-directors.gl.at.ply.gg:56448

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    Bitdefender.exe

  • copy_folder

    Bitdefender

  • delete_file

    true

  • hide_file

    true

  • hide_keylog_file

    false

  • install_flag

    true

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-XTM51M

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    VisualStudioServer

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Remcos family
  • UAC bypass 3 TTPs 3 IoCs
  • Adds policy Run key to start application 2 TTPs 6 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry key 1 TTPs 3 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\QD0FZ_stub.exe
    "C:\Users\Admin\AppData\Local\Temp\QD0FZ_stub.exe"
    1⤵
    • Adds policy Run key to start application
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1740
    • C:\Windows\SysWOW64\cmd.exe
      /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2400
      • C:\Windows\SysWOW64\reg.exe
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        3⤵
        • UAC bypass
        • System Location Discovery: System Language Discovery
        • Modifies registry key
        PID:2716
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2684
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\Bitdefender\Bitdefender.exe"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2816
        • C:\ProgramData\Bitdefender\Bitdefender.exe
          C:\ProgramData\Bitdefender\Bitdefender.exe
          4⤵
          • Adds policy Run key to start application
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:2928
          • C:\Windows\SysWOW64\cmd.exe
            /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:108
            • C:\Windows\SysWOW64\reg.exe
              C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
              6⤵
              • UAC bypass
              • System Location Discovery: System Language Discovery
              • Modifies registry key
              PID:1348
          • \??\c:\program files (x86)\internet explorer\iexplore.exe
            "c:\program files (x86)\internet explorer\iexplore.exe"
            5⤵
            • Adds policy Run key to start application
            • Adds Run key to start application
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:2724
            • C:\Windows\SysWOW64\cmd.exe
              /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2076
              • C:\Windows\SysWOW64\reg.exe
                C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                7⤵
                • UAC bypass
                • System Location Discovery: System Language Discovery
                • Modifies registry key
                PID:2636
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              6⤵
                PID:2728
              • C:\Windows\SysWOW64\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ugwmoihbmoaefd.vbs"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:984

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\install.vbs

      Filesize

      538B

      MD5

      0d300850c4b872ee0997c0714d8946f8

      SHA1

      c63b8f1a899b32bfb76555c22e3d91f6cb801256

      SHA256

      025c871f620d631d578513c4dea28a0870ce306eb90ba2e19ef8ca641ba20ed9

      SHA512

      ac704d9db7c78b12051e919d9b15d63bf62c2c0ed01ebe2a824a545df44c47fb0ed80af647a77c25ffa4fe1ade7c01151e8ac187118c15b6dbfbea3ce36ff7da

    • C:\Users\Admin\AppData\Local\Temp\ugwmoihbmoaefd.vbs

      Filesize

      580B

      MD5

      3acb59fed7a8eb82ab2dafe7964abe36

      SHA1

      a18fe9a9e10edc38c8f326a254f643892d24e2d4

      SHA256

      e01b68ba47caab4271202c88172dfd0f3917c9c034a8f0188430388e1c6f9dde

      SHA512

      c483d1f9cb129d3b99af543a888133c98a779332a522fb0860255c34782f97bb0028153195b39c9300d00ff5b6e93b4aa57aef820dad3a63ed52be930a052ef5

    • \ProgramData\Bitdefender\Bitdefender.exe

      Filesize

      469KB

      MD5

      e7be6cad5e537ccd392c2a1aefa60ee7

      SHA1

      324b9688a5d8c39f5e96e41f451cfc9a225d48d2

      SHA256

      8c7a4657ea68a69f364c8acb1881aa6e0f8140d3aba9a917f484ba6ec705db21

      SHA512

      0fc526f228ace907e580433d7e85e170ebfdc1eae24cf21d2e35568007f30abf517de2c215b1718ed31787e0ebfdafd89f11e6214f09f01492f75fe209c09037

    • memory/2724-37-0x0000000000080000-0x00000000000FF000-memory.dmp

      Filesize

      508KB

    • memory/2724-33-0x0000000000080000-0x00000000000FF000-memory.dmp

      Filesize

      508KB

    • memory/2724-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2724-12-0x0000000000080000-0x00000000000FF000-memory.dmp

      Filesize

      508KB

    • memory/2724-49-0x0000000000080000-0x00000000000FF000-memory.dmp

      Filesize

      508KB

    • memory/2724-45-0x0000000000080000-0x00000000000FF000-memory.dmp

      Filesize

      508KB

    • memory/2724-19-0x0000000000080000-0x00000000000FF000-memory.dmp

      Filesize

      508KB

    • memory/2724-20-0x0000000000080000-0x00000000000FF000-memory.dmp

      Filesize

      508KB

    • memory/2724-31-0x0000000000080000-0x00000000000FF000-memory.dmp

      Filesize

      508KB

    • memory/2724-22-0x0000000000080000-0x00000000000FF000-memory.dmp

      Filesize

      508KB

    • memory/2724-26-0x0000000000080000-0x00000000000FF000-memory.dmp

      Filesize

      508KB

    • memory/2724-25-0x0000000000080000-0x00000000000FF000-memory.dmp

      Filesize

      508KB

    • memory/2724-27-0x0000000000080000-0x00000000000FF000-memory.dmp

      Filesize

      508KB

    • memory/2724-28-0x0000000000080000-0x00000000000FF000-memory.dmp

      Filesize

      508KB

    • memory/2724-11-0x0000000000080000-0x00000000000FF000-memory.dmp

      Filesize

      508KB

    • memory/2724-29-0x0000000000080000-0x00000000000FF000-memory.dmp

      Filesize

      508KB

    • memory/2724-21-0x0000000000080000-0x00000000000FF000-memory.dmp

      Filesize

      508KB

    • memory/2724-30-0x0000000000080000-0x00000000000FF000-memory.dmp

      Filesize

      508KB

    • memory/2724-32-0x0000000000080000-0x00000000000FF000-memory.dmp

      Filesize

      508KB

    • memory/2724-34-0x0000000000080000-0x00000000000FF000-memory.dmp

      Filesize

      508KB

    • memory/2724-36-0x0000000000080000-0x00000000000FF000-memory.dmp

      Filesize

      508KB

    • memory/2724-13-0x0000000000080000-0x00000000000FF000-memory.dmp

      Filesize

      508KB

    • memory/2724-38-0x0000000000080000-0x00000000000FF000-memory.dmp

      Filesize

      508KB

    • memory/2724-39-0x0000000000080000-0x00000000000FF000-memory.dmp

      Filesize

      508KB

    • memory/2724-40-0x0000000000080000-0x00000000000FF000-memory.dmp

      Filesize

      508KB

    • memory/2724-41-0x0000000000080000-0x00000000000FF000-memory.dmp

      Filesize

      508KB

    • memory/2724-42-0x0000000000080000-0x00000000000FF000-memory.dmp

      Filesize

      508KB

    • memory/2724-43-0x0000000000080000-0x00000000000FF000-memory.dmp

      Filesize

      508KB

    • memory/2724-44-0x0000000000080000-0x00000000000FF000-memory.dmp

      Filesize

      508KB

    • memory/2728-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2728-17-0x00000000000F0000-0x000000000016F000-memory.dmp

      Filesize

      508KB

    • memory/2728-18-0x00000000000F0000-0x000000000016F000-memory.dmp

      Filesize

      508KB