Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09/12/2024, 07:30

General

  • Target

    Justificante de pago.exe

  • Size

    1001KB

  • MD5

    0c0b566099d8f32313cac142624e9b89

  • SHA1

    c91bd91424a20a9d45cc62cd3aaa85afefe60a74

  • SHA256

    e47dfbb5bd64ac09562d7d20618ba7f024a0b7547d864217feb0586f7145cdb0

  • SHA512

    de9de86a26a0d0eee105908e1c378be6c18a99a4c03b7d8a6e9d2049a0fc830903e077684156928d7b97176c6fa05a6d9e66793760e2a9edd1b54dd22c98fa2d

  • SSDEEP

    24576:2oIeeaYI32l/Pow+E9rW2rtaldr+3dmBABsNJUI:JBeaWl/Pow+EW2RaLrbw

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

127.0.0.1:7643

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-14OQCD

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Remcos family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Justificante de pago.exe
    "C:\Users\Admin\AppData\Local\Temp\Justificante de pago.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1660
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Justificante de pago.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2556
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TYLngHLuy.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2704
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TYLngHLuy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3FFD.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2728
    • C:\Users\Admin\AppData\Local\Temp\Justificante de pago.exe
      "C:\Users\Admin\AppData\Local\Temp\Justificante de pago.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:1364

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\remcos\logs.dat

    Filesize

    144B

    MD5

    196e6e60d89001b9bd380dff4d428d26

    SHA1

    1098c57947878a0ebf09400a488f6ec0a7ddd871

    SHA256

    646917914ea392f047d47fbff7744d3b1eec9a1ab4f5ff1ec73062190aa89b68

    SHA512

    d75a774c86e4819ad680d4b109fe303416f4152c362a5c18323d61b733da007aea4dac2c2d8f297b6ca450dd71528cc2d201553c52949f4d57ac44f10812df81

  • C:\Users\Admin\AppData\Local\Temp\tmp3FFD.tmp

    Filesize

    1KB

    MD5

    ce28a8c7a27f2d5ba1c9abf26f4361b3

    SHA1

    d545c2cc1ce390474d6638636ae5fae6ee7a9246

    SHA256

    874620e688a695146508375a8bf09e27ac9bc8065e8e70c8718985866a8620f1

    SHA512

    1affbd00d30ade83cd2182b123eeb098870193cba563331079b8fb5b20173e55c1cf84fecd77c9ed9cbff9c8f7b186d267bdab84c0eda29d29d8a27bcc8786dd

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KRYZ49XGURY2HG03V7WR.temp

    Filesize

    7KB

    MD5

    a1cb58b1d9e899b7fec36fec72462ca4

    SHA1

    7bf3dfc584544d1319c1fffa925217697dc8ac0e

    SHA256

    032d07874a7a8353d6238df64678a6dd75b0ecd36912f6338739ed179e13ce1d

    SHA512

    66d6badbf61464869702947eda1bc8663c5c580936cced1cd1116094959be174cd8ffe974fb1a459d76bc0988dc4384222a1a4cbae36abf8fb32a415ab29a8ba

  • memory/1364-52-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-57-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-91-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-90-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-37-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-34-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-33-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-30-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-27-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-89-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-88-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-87-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-85-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-84-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-83-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-25-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-23-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-19-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-31-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/1364-40-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-41-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-42-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-43-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-45-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-46-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-47-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-48-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-49-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-51-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-32-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-38-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-53-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-65-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-54-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-58-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-59-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-60-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-61-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-63-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-64-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-55-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-66-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-67-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-21-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-69-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-70-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-71-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-72-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-73-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-75-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-76-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-77-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-78-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-79-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-81-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1364-82-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/1660-39-0x0000000074CA0000-0x000000007538E000-memory.dmp

    Filesize

    6.9MB

  • memory/1660-6-0x00000000076E0000-0x00000000077A4000-memory.dmp

    Filesize

    784KB

  • memory/1660-5-0x0000000074CA0000-0x000000007538E000-memory.dmp

    Filesize

    6.9MB

  • memory/1660-4-0x0000000074CAE000-0x0000000074CAF000-memory.dmp

    Filesize

    4KB

  • memory/1660-3-0x0000000000240000-0x0000000000258000-memory.dmp

    Filesize

    96KB

  • memory/1660-2-0x0000000074CA0000-0x000000007538E000-memory.dmp

    Filesize

    6.9MB

  • memory/1660-1-0x0000000001210000-0x0000000001310000-memory.dmp

    Filesize

    1024KB

  • memory/1660-0-0x0000000074CAE000-0x0000000074CAF000-memory.dmp

    Filesize

    4KB