Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/11/2024, 03:42

General

  • Target

    Bank Fund Transfer-589237.scr

  • Size

    1.2MB

  • MD5

    552044ce92b78bf4b68d242c2c380afe

  • SHA1

    2ef4efa20f4fd0d05d8f49ccb22c9afeada93a62

  • SHA256

    cac29565b48f92e8c7a43b7dcca13294bae02890c26df75ae5e5ee31a464e4f3

  • SHA512

    4dc5ef0fb4b80a81015f4507422a67309074ea01787c9ed0d18c850a1d98ea1e3a444993a1d08428331e2ff044390c873d20c31ffbae049e325a82b64d5a3967

  • SSDEEP

    24576:6YdgfvzmIzxWOwxzCJYC3PPoKb0Eci5ihjJVxw9bYOd+8:qzmmWXRCaePPjb0Eci5ih7xw9bYI

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

212.162.149.226:9285

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    AppUpdate

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    true

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-VCJ8ZS

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    AppUpdate

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Remcos family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 51 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Bank Fund Transfer-589237.scr
    "C:\Users\Admin\AppData\Local\Temp\Bank Fund Transfer-589237.scr" /S
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:436
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Bank Fund Transfer-589237.scr"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2400
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uCItbEGgKu.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5096
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uCItbEGgKu" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC515.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:4344
    • C:\Users\Admin\AppData\Local\Temp\Bank Fund Transfer-589237.scr
      "C:\Users\Admin\AppData\Local\Temp\Bank Fund Transfer-589237.scr"
      2⤵
      • Checks computer location settings
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1824
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        3⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1980
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\AppUpdate\remcos.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4040
          • C:\ProgramData\AppUpdate\remcos.exe
            C:\ProgramData\AppUpdate\remcos.exe
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3940
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\AppUpdate\remcos.exe"
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3376
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uCItbEGgKu.exe"
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4556
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uCItbEGgKu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp33AD.tmp"
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:2960
            • C:\ProgramData\AppUpdate\remcos.exe
              "C:\ProgramData\AppUpdate\remcos.exe"
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              PID:992

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\AppUpdate\remcos.exe

    Filesize

    1.2MB

    MD5

    552044ce92b78bf4b68d242c2c380afe

    SHA1

    2ef4efa20f4fd0d05d8f49ccb22c9afeada93a62

    SHA256

    cac29565b48f92e8c7a43b7dcca13294bae02890c26df75ae5e5ee31a464e4f3

    SHA512

    4dc5ef0fb4b80a81015f4507422a67309074ea01787c9ed0d18c850a1d98ea1e3a444993a1d08428331e2ff044390c873d20c31ffbae049e325a82b64d5a3967

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    3d086a433708053f9bf9523e1d87a4e8

    SHA1

    b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

    SHA256

    6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

    SHA512

    931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    f921955320fea8dbd8bcd2012a8f3722

    SHA1

    76e5dd6c0c97dadd09d306ad015de99f6515ca31

    SHA256

    93511ac822917e92f0b1bd8eee5698306e99318af437271b45b035dbf468e931

    SHA512

    b55bfa52377cd61ce970d4dfa46e5f854df7d19a8cd413c6ae8fa3f83e389c96ffd3e7bd731047b9a0f811097b573f236703cbeb136a4801f9f47a8f8519b4bc

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    d658928900af3b47b57d64bd3b71bef4

    SHA1

    cf7ab674cbbf872f76bad17a291785d483ec84ae

    SHA256

    c08af78c58cd9138bee650358192f7b5668c07a131ca416b9e15965794a8ffac

    SHA512

    411efe34eb32be83191ed90700a6c77cb0c7997831e0df9fed0dcdcea530d1df514191693394a80e843829bdc60b289809ab9525d100271d8520c50709d09ed4

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mzt45qoh.jqj.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\install.vbs

    Filesize

    392B

    MD5

    046708368578d720d91fb9ceecec742e

    SHA1

    1dc732f67f48a1d5694f4cf14a8d279dbd1d6ee6

    SHA256

    04f4edc28e97a16f93cf7acac864aba17cc467282550ae61baac719262be6f5e

    SHA512

    9106f645ee74c9e061fcb396a00d706512d41054a356125f26a10d42390d8f0d3ea3dd785393bf5de358b62464ec3c0f7d2e27411e87bb408581f820c427e7f0

  • C:\Users\Admin\AppData\Local\Temp\tmpC515.tmp

    Filesize

    1KB

    MD5

    ce975596e0d2ad3e251ef6627f3339cc

    SHA1

    6d00ae25f67e46a7a45c218807f1046c1c6a5621

    SHA256

    6ee200af49713a05e56cc4e71e75a230da819d322a5d25a754343e96a66ca105

    SHA512

    ff92a3f1844210d3b855a4485c06edcf70b387d98ca9b9bc508418875d973140c9ac27dcb728e2f82561e31a8dc83ad8cfa4f7ccd764eff09859782289768431

  • memory/436-4-0x00000000750C0000-0x0000000075870000-memory.dmp

    Filesize

    7.7MB

  • memory/436-8-0x00000000750CE000-0x00000000750CF000-memory.dmp

    Filesize

    4KB

  • memory/436-9-0x00000000750C0000-0x0000000075870000-memory.dmp

    Filesize

    7.7MB

  • memory/436-10-0x0000000005960000-0x0000000005A20000-memory.dmp

    Filesize

    768KB

  • memory/436-7-0x0000000005460000-0x0000000005472000-memory.dmp

    Filesize

    72KB

  • memory/436-6-0x00000000056E0000-0x000000000577C000-memory.dmp

    Filesize

    624KB

  • memory/436-5-0x0000000005410000-0x000000000541A000-memory.dmp

    Filesize

    40KB

  • memory/436-3-0x0000000005350000-0x00000000053E2000-memory.dmp

    Filesize

    584KB

  • memory/436-51-0x00000000750C0000-0x0000000075870000-memory.dmp

    Filesize

    7.7MB

  • memory/436-0-0x00000000750CE000-0x00000000750CF000-memory.dmp

    Filesize

    4KB

  • memory/436-2-0x0000000005A30000-0x0000000005FD4000-memory.dmp

    Filesize

    5.6MB

  • memory/436-1-0x0000000000840000-0x0000000000970000-memory.dmp

    Filesize

    1.2MB

  • memory/992-160-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/992-115-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/992-152-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/992-130-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/992-165-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/992-164-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/992-114-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/992-116-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/992-161-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/992-162-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/992-140-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/992-163-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1824-37-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1824-36-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2400-80-0x0000000007890000-0x00000000078AE000-memory.dmp

    Filesize

    120KB

  • memory/2400-61-0x0000000071830000-0x000000007187C000-memory.dmp

    Filesize

    304KB

  • memory/2400-60-0x00000000078B0000-0x00000000078E2000-memory.dmp

    Filesize

    200KB

  • memory/2400-82-0x00000000078F0000-0x0000000007993000-memory.dmp

    Filesize

    652KB

  • memory/2400-83-0x0000000008050000-0x00000000086CA000-memory.dmp

    Filesize

    6.5MB

  • memory/2400-84-0x0000000007A10000-0x0000000007A2A000-memory.dmp

    Filesize

    104KB

  • memory/2400-15-0x0000000002DD0000-0x0000000002E06000-memory.dmp

    Filesize

    216KB

  • memory/2400-86-0x0000000007C90000-0x0000000007D26000-memory.dmp

    Filesize

    600KB

  • memory/2400-16-0x00000000750C0000-0x0000000075870000-memory.dmp

    Filesize

    7.7MB

  • memory/2400-19-0x00000000750C0000-0x0000000075870000-memory.dmp

    Filesize

    7.7MB

  • memory/2400-89-0x0000000007C50000-0x0000000007C64000-memory.dmp

    Filesize

    80KB

  • memory/2400-90-0x0000000007D50000-0x0000000007D6A000-memory.dmp

    Filesize

    104KB

  • memory/2400-18-0x0000000005890000-0x0000000005EB8000-memory.dmp

    Filesize

    6.2MB

  • memory/2400-22-0x0000000005750000-0x00000000057B6000-memory.dmp

    Filesize

    408KB

  • memory/2400-17-0x00000000750C0000-0x0000000075870000-memory.dmp

    Filesize

    7.7MB

  • memory/2400-20-0x0000000005630000-0x0000000005652000-memory.dmp

    Filesize

    136KB

  • memory/2400-98-0x00000000750C0000-0x0000000075870000-memory.dmp

    Filesize

    7.7MB

  • memory/2400-35-0x0000000006130000-0x0000000006484000-memory.dmp

    Filesize

    3.3MB

  • memory/2400-23-0x00000000060C0000-0x0000000006126000-memory.dmp

    Filesize

    408KB

  • memory/3376-111-0x0000000005F30000-0x0000000006284000-memory.dmp

    Filesize

    3.3MB

  • memory/3376-154-0x0000000007880000-0x0000000007894000-memory.dmp

    Filesize

    80KB

  • memory/3376-153-0x0000000007840000-0x0000000007851000-memory.dmp

    Filesize

    68KB

  • memory/3376-128-0x0000000006360000-0x00000000063AC000-memory.dmp

    Filesize

    304KB

  • memory/3376-129-0x0000000075950000-0x000000007599C000-memory.dmp

    Filesize

    304KB

  • memory/3376-141-0x0000000007500000-0x00000000075A3000-memory.dmp

    Filesize

    652KB

  • memory/3940-99-0x0000000004C70000-0x0000000004C82000-memory.dmp

    Filesize

    72KB

  • memory/4556-142-0x0000000075950000-0x000000007599C000-memory.dmp

    Filesize

    304KB

  • memory/5096-55-0x00000000066F0000-0x000000000670E000-memory.dmp

    Filesize

    120KB

  • memory/5096-24-0x00000000750C0000-0x0000000075870000-memory.dmp

    Filesize

    7.7MB

  • memory/5096-40-0x00000000750C0000-0x0000000075870000-memory.dmp

    Filesize

    7.7MB

  • memory/5096-30-0x00000000750C0000-0x0000000075870000-memory.dmp

    Filesize

    7.7MB

  • memory/5096-71-0x0000000071830000-0x000000007187C000-memory.dmp

    Filesize

    304KB

  • memory/5096-97-0x00000000750C0000-0x0000000075870000-memory.dmp

    Filesize

    7.7MB

  • memory/5096-56-0x0000000006710000-0x000000000675C000-memory.dmp

    Filesize

    304KB

  • memory/5096-91-0x0000000007D30000-0x0000000007D38000-memory.dmp

    Filesize

    32KB

  • memory/5096-88-0x0000000007C40000-0x0000000007C4E000-memory.dmp

    Filesize

    56KB

  • memory/5096-87-0x0000000007C10000-0x0000000007C21000-memory.dmp

    Filesize

    68KB

  • memory/5096-85-0x0000000007A80000-0x0000000007A8A000-memory.dmp

    Filesize

    40KB