Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    21/11/2024, 03:46

General

  • Target

    Bank Fund Transfer-589237.scr

  • Size

    1.2MB

  • MD5

    552044ce92b78bf4b68d242c2c380afe

  • SHA1

    2ef4efa20f4fd0d05d8f49ccb22c9afeada93a62

  • SHA256

    cac29565b48f92e8c7a43b7dcca13294bae02890c26df75ae5e5ee31a464e4f3

  • SHA512

    4dc5ef0fb4b80a81015f4507422a67309074ea01787c9ed0d18c850a1d98ea1e3a444993a1d08428331e2ff044390c873d20c31ffbae049e325a82b64d5a3967

  • SSDEEP

    24576:6YdgfvzmIzxWOwxzCJYC3PPoKb0Eci5ihjJVxw9bYOd+8:qzmmWXRCaePPjb0Eci5ih7xw9bYI

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

212.162.149.226:9285

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    AppUpdate

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    true

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-VCJ8ZS

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    AppUpdate

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Remcos family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 62 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Bank Fund Transfer-589237.scr
    "C:\Users\Admin\AppData\Local\Temp\Bank Fund Transfer-589237.scr" /S
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2644
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Bank Fund Transfer-589237.scr"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2900
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uCItbEGgKu.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2576
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uCItbEGgKu" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB2BC.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2720
    • C:\Users\Admin\AppData\Local\Temp\Bank Fund Transfer-589237.scr
      "C:\Users\Admin\AppData\Local\Temp\Bank Fund Transfer-589237.scr"
      2⤵
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3000
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2972
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\AppUpdate\remcos.exe"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:808
          • C:\ProgramData\AppUpdate\remcos.exe
            C:\ProgramData\AppUpdate\remcos.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2028
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\AppUpdate\remcos.exe"
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1672
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uCItbEGgKu.exe"
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2136
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uCItbEGgKu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1CC4.tmp"
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:2132
            • C:\ProgramData\AppUpdate\remcos.exe
              "C:\ProgramData\AppUpdate\remcos.exe"
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              PID:2928

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\install.vbs

    Filesize

    392B

    MD5

    046708368578d720d91fb9ceecec742e

    SHA1

    1dc732f67f48a1d5694f4cf14a8d279dbd1d6ee6

    SHA256

    04f4edc28e97a16f93cf7acac864aba17cc467282550ae61baac719262be6f5e

    SHA512

    9106f645ee74c9e061fcb396a00d706512d41054a356125f26a10d42390d8f0d3ea3dd785393bf5de358b62464ec3c0f7d2e27411e87bb408581f820c427e7f0

  • C:\Users\Admin\AppData\Local\Temp\tmpB2BC.tmp

    Filesize

    1KB

    MD5

    c464bf85ef275a5c4571456b842a6793

    SHA1

    fc9eadc99ead34ffe4d2557d033ca19a1a384d71

    SHA256

    575e445bfc922b8a3148c87d366ad46a481cfdcf0db857880e6920348600e552

    SHA512

    3d62fb8b674d2c4783f037e3923465760fa3e48f33fa7f63864c1040925ddddd39654f3dd49b1eaf3e7d881e7d1ba0186fb8c7c254b2ccf38e052a1fbb24d5ec

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KBH5SAV8SMYG0DYT2XNJ.temp

    Filesize

    7KB

    MD5

    9439dcb3b286cf608f40b177bc6f006b

    SHA1

    1ee3990facb11f3770701bcfa2b1802dabac1ce6

    SHA256

    d0eef15760eeedfbd0c8ab596e72bd123c89426aaad2f3f19855c0cdef436253

    SHA512

    16ea69a96f40c0796a0b412e8d72882037ad29d61b74282e2b6b8223de454d9e045fa99907db733cf71b65e975b9083d25a51d8c30a288f6c8a4398f906620cf

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\WGCKS3Y21J11QVITKRFH.temp

    Filesize

    7KB

    MD5

    b35a9f3eea827cb3717b7ed5542b5cb8

    SHA1

    bc83da0bbb11f6d1caa2755a85e5e8214589c4a6

    SHA256

    4a910787d968b73d8f026a9f2f3f05c786dfefd045b1f497602f5fb9ce27271c

    SHA512

    ad25e3ff37c4f67ffe725cae57bf233bda494fbc8741794ab69b5f8937db6c3e7031f3a39b58bae8d7387e68f26e67c212dfc123b2c172917d3629933f4dd101

  • \ProgramData\AppUpdate\remcos.exe

    Filesize

    1.2MB

    MD5

    552044ce92b78bf4b68d242c2c380afe

    SHA1

    2ef4efa20f4fd0d05d8f49ccb22c9afeada93a62

    SHA256

    cac29565b48f92e8c7a43b7dcca13294bae02890c26df75ae5e5ee31a464e4f3

    SHA512

    4dc5ef0fb4b80a81015f4507422a67309074ea01787c9ed0d18c850a1d98ea1e3a444993a1d08428331e2ff044390c873d20c31ffbae049e325a82b64d5a3967

  • memory/2028-47-0x0000000000C50000-0x0000000000D80000-memory.dmp

    Filesize

    1.2MB

  • memory/2028-48-0x0000000000260000-0x0000000000272000-memory.dmp

    Filesize

    72KB

  • memory/2644-42-0x00000000741C0000-0x00000000748AE000-memory.dmp

    Filesize

    6.9MB

  • memory/2644-5-0x00000000741C0000-0x00000000748AE000-memory.dmp

    Filesize

    6.9MB

  • memory/2644-6-0x0000000004DC0000-0x0000000004E80000-memory.dmp

    Filesize

    768KB

  • memory/2644-3-0x0000000000580000-0x0000000000592000-memory.dmp

    Filesize

    72KB

  • memory/2644-0-0x00000000741CE000-0x00000000741CF000-memory.dmp

    Filesize

    4KB

  • memory/2644-2-0x00000000741C0000-0x00000000748AE000-memory.dmp

    Filesize

    6.9MB

  • memory/2644-4-0x00000000741CE000-0x00000000741CF000-memory.dmp

    Filesize

    4KB

  • memory/2644-1-0x00000000008E0000-0x0000000000A10000-memory.dmp

    Filesize

    1.2MB

  • memory/2928-84-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2928-85-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2928-94-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2928-93-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2928-92-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2928-91-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2928-90-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2928-89-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2928-86-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2928-78-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2928-81-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2928-83-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2928-82-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3000-33-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3000-19-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3000-21-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3000-27-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3000-36-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3000-37-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3000-35-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/3000-31-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3000-29-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3000-23-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3000-25-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB