Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21/11/2024, 03:42

General

  • Target

    Bank Fund Transfer-589237.scr

  • Size

    1.2MB

  • MD5

    552044ce92b78bf4b68d242c2c380afe

  • SHA1

    2ef4efa20f4fd0d05d8f49ccb22c9afeada93a62

  • SHA256

    cac29565b48f92e8c7a43b7dcca13294bae02890c26df75ae5e5ee31a464e4f3

  • SHA512

    4dc5ef0fb4b80a81015f4507422a67309074ea01787c9ed0d18c850a1d98ea1e3a444993a1d08428331e2ff044390c873d20c31ffbae049e325a82b64d5a3967

  • SSDEEP

    24576:6YdgfvzmIzxWOwxzCJYC3PPoKb0Eci5ihjJVxw9bYOd+8:qzmmWXRCaePPjb0Eci5ih7xw9bYI

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

212.162.149.226:9285

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    AppUpdate

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    true

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-VCJ8ZS

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    AppUpdate

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Remcos family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 62 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Bank Fund Transfer-589237.scr
    "C:\Users\Admin\AppData\Local\Temp\Bank Fund Transfer-589237.scr" /S
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2524
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Bank Fund Transfer-589237.scr"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2840
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uCItbEGgKu.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2768
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uCItbEGgKu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1777.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:764
    • C:\Users\Admin\AppData\Local\Temp\Bank Fund Transfer-589237.scr
      "C:\Users\Admin\AppData\Local\Temp\Bank Fund Transfer-589237.scr"
      2⤵
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2620
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1004
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\AppUpdate\remcos.exe"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1704
          • C:\ProgramData\AppUpdate\remcos.exe
            C:\ProgramData\AppUpdate\remcos.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2364
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\AppUpdate\remcos.exe"
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2220
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uCItbEGgKu.exe"
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3064
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uCItbEGgKu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8037.tmp"
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:2240
            • C:\ProgramData\AppUpdate\remcos.exe
              "C:\ProgramData\AppUpdate\remcos.exe"
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              PID:3024

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\AppUpdate\remcos.exe

    Filesize

    1.2MB

    MD5

    552044ce92b78bf4b68d242c2c380afe

    SHA1

    2ef4efa20f4fd0d05d8f49ccb22c9afeada93a62

    SHA256

    cac29565b48f92e8c7a43b7dcca13294bae02890c26df75ae5e5ee31a464e4f3

    SHA512

    4dc5ef0fb4b80a81015f4507422a67309074ea01787c9ed0d18c850a1d98ea1e3a444993a1d08428331e2ff044390c873d20c31ffbae049e325a82b64d5a3967

  • C:\Users\Admin\AppData\Local\Temp\install.vbs

    Filesize

    392B

    MD5

    046708368578d720d91fb9ceecec742e

    SHA1

    1dc732f67f48a1d5694f4cf14a8d279dbd1d6ee6

    SHA256

    04f4edc28e97a16f93cf7acac864aba17cc467282550ae61baac719262be6f5e

    SHA512

    9106f645ee74c9e061fcb396a00d706512d41054a356125f26a10d42390d8f0d3ea3dd785393bf5de358b62464ec3c0f7d2e27411e87bb408581f820c427e7f0

  • C:\Users\Admin\AppData\Local\Temp\tmp1777.tmp

    Filesize

    1KB

    MD5

    1b7a99f00e695978e48aae7bc86e369f

    SHA1

    2c4e0928f09e48ba3e0c5d36a2bb577cf33c5349

    SHA256

    e4d0746d3af5131925e0b200053a210a02ea9c4092fe7c13ea504dc0781f705d

    SHA512

    a41065a9ef5f77b18afbb8cbf17bfab18767230cf1d3c06ef8a35df7877c178390ad332140ecfae9f5753613cb8906e0348820e60bfbf44daca8100de672157c

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\NWCCFJBYBSMNKKANFF5S.temp

    Filesize

    7KB

    MD5

    1b6283bc9e300a796ab5a01e36a9a5d7

    SHA1

    e652f54c92ddd7fb4f467e243c4c92d974818062

    SHA256

    ed18fd308dbe2720a6f041b32d56a521cd2d53f2fc2855699cea015d33900af0

    SHA512

    5f042e5318bc8ff318d6045912ec41d4761cfe673bb6dfd421b24633c5ce9baafe058fc587cc5e3f67bd672ac6fe5ff49e9406d436b36afc43ae2f1c21dee365

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    Filesize

    7KB

    MD5

    452db212842c84433e5e2b98dde1a52d

    SHA1

    f9fe0533146cc776ebd81cc22895a2bcfcf615d9

    SHA256

    067e48972f79b727ceb44a2d9bf45541075768e514f0def652c0b0a542d20556

    SHA512

    e1f8523c9186aeb8afcb87eade302db005f6f7696de4a528d8db5838caad9794d323467d3b9f62227eb244df660c7ae546c8f89c09ad48ebe873f79a0647ec2a

  • memory/2364-46-0x0000000000840000-0x0000000000970000-memory.dmp

    Filesize

    1.2MB

  • memory/2364-47-0x00000000003A0000-0x00000000003B2000-memory.dmp

    Filesize

    72KB

  • memory/2524-3-0x0000000000420000-0x0000000000432000-memory.dmp

    Filesize

    72KB

  • memory/2524-5-0x00000000052C0000-0x0000000005380000-memory.dmp

    Filesize

    768KB

  • memory/2524-0-0x00000000742BE000-0x00000000742BF000-memory.dmp

    Filesize

    4KB

  • memory/2524-4-0x00000000742B0000-0x000000007499E000-memory.dmp

    Filesize

    6.9MB

  • memory/2524-39-0x00000000742B0000-0x000000007499E000-memory.dmp

    Filesize

    6.9MB

  • memory/2524-2-0x00000000742B0000-0x000000007499E000-memory.dmp

    Filesize

    6.9MB

  • memory/2524-1-0x0000000000E40000-0x0000000000F70000-memory.dmp

    Filesize

    1.2MB

  • memory/2620-30-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2620-28-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2620-26-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2620-24-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2620-32-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2620-22-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2620-20-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2620-34-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2620-35-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2620-36-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2620-18-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3024-79-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3024-81-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3024-80-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3024-76-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/3024-82-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3024-83-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3024-84-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3024-87-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3024-88-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3024-89-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3024-90-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3024-92-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3024-91-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB