Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    299s
  • max time network
    299s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    14/12/2024, 01:25

General

  • Target

    RTM09878GH.exe

  • Size

    830KB

  • MD5

    c48a8f69e18ada31f2d4cce1c01f21a4

  • SHA1

    3af7a6a8653982efebe40fdc85a056906e1c5d51

  • SHA256

    8bf7fa237fb9b84868540e4823ee8532d879defebf58267085384ceb117b1c0e

  • SHA512

    6a1d7d22c699b99d9a07b580dd15986cd1d7fb104d1b898f851b446799941736d0e2bf6e37b735a65d4005ed19a71ab4c578587ac3abe5cec6da5a44d6a0008c

  • SSDEEP

    24576:N24ds1x0hwCSfnS5OVx6/Z7XtuQiMSGsX6eYc799exzCQryh+9:dmqOMh7DiMS/Rex+QWI9

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

192.210.150.26:3678

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-MKYDDH

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Remcos family
  • UAC bypass 3 TTPs 1 IoCs
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RTM09878GH.exe
    "C:\Users\Admin\AppData\Local\Temp\RTM09878GH.exe"
    1⤵
    • UAC bypass
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Maps connected drives based on registry
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2524
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\RTM09878GH.exe" -Force
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2288
    • C:\Windows\System32\calc.exe
      "C:\Windows\System32\calc.exe"
      2⤵
        PID:2724
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2876
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 2524 -s 900
        2⤵
          PID:2840

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\remcos\logs.dat

        Filesize

        152B

        MD5

        7ef710c378ccc268ae828ad7ca1a397d

        SHA1

        27bbf69d874412fcd6a056e6dd450ca87b52ea72

        SHA256

        88b777e09f5a10d402dcd7854dcb41b722aed6c426016642cf582970b3efbc45

        SHA512

        599158c684d6f9996a20f9e34897dbddbd19bc758f8e53c94e0c6bdd801a231d972bef960f0f0ff50cee602cc0c64c64afa20093a25497905839cb1829a1db24

      • memory/2288-17-0x000000001B4C0000-0x000000001B7A2000-memory.dmp

        Filesize

        2.9MB

      • memory/2288-18-0x0000000001D90000-0x0000000001D98000-memory.dmp

        Filesize

        32KB

      • memory/2524-1-0x0000000000DA0000-0x0000000000E74000-memory.dmp

        Filesize

        848KB

      • memory/2524-2-0x000000001B0B0000-0x000000001B180000-memory.dmp

        Filesize

        832KB

      • memory/2524-3-0x000007FEF6000000-0x000007FEF69EC000-memory.dmp

        Filesize

        9.9MB

      • memory/2524-21-0x000007FEF6000000-0x000007FEF69EC000-memory.dmp

        Filesize

        9.9MB

      • memory/2524-0-0x000007FEF6003000-0x000007FEF6004000-memory.dmp

        Filesize

        4KB

      • memory/2724-7-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/2724-4-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/2724-5-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/2724-6-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/2724-9-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/2724-11-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/2876-19-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB