Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    897s
  • max time network
    894s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/01/2025, 00:33

General

  • Target

    Confirmation_028387373736_Copies_6761fa19c0f9d_293874738_IMG__REF2632737463773364_221.exe

  • Size

    1.2MB

  • MD5

    14950122eb9408da25415925f2d640c1

  • SHA1

    a0a700a23a76d1a74e4bfeea70285b031e4632a5

  • SHA256

    bab2fe1464095154de3715f90f92351a3f462bebac4d6a7dd52bc1411c6964cc

  • SHA512

    fe514613a05a531588a186ee2caf4438a263e10689d509cc8bfba8b5aecce72c2f7bc065a2a2599e9612080ad27c6907d24fe263fe105d48f111fb1e3252614c

  • SSDEEP

    24576:msyGmpFPxXbdq3hwbS5nrm9utI2SnS4ZxE:msy/pF9AAKq8MZxE

Malware Config

Extracted

Family

remcos

Botnet

UPDATEIP

C2

suregigg2.redirectme.net:4689

suregigg2.redirectme.net:4688

oaziamaka.duckdns.org:4688

oaziamaka.duckdns.org:4689

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    true

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    aleopty.dat

  • keylog_flag

    false

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    deokwensgb-XP0DHK

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Remcos family
  • Detected Nirsoft tools 3 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView 1 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 1 IoCs

    Password recovery tool for various web browsers

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Blocklisted process makes network request 4 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Confirmation_028387373736_Copies_6761fa19c0f9d_293874738_IMG__REF2632737463773364_221.exe
    "C:\Users\Admin\AppData\Local\Temp\Confirmation_028387373736_Copies_6761fa19c0f9d_293874738_IMG__REF2632737463773364_221.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3676
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -windowstyle hidden "$Terriner=gc -Raw 'C:\Users\Admin\AppData\Local\reguladetriens\Frygts\Udflippedes47\Kumisses.Ins';$Phellogenetic=$Terriner.SubString(69463,3);.$Phellogenetic($Terriner)"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4824
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\SysWOW64\msiexec.exe"
        3⤵
        • Blocklisted process makes network request
        • Suspicious use of NtCreateThreadExHideFromDebugger
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2384
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Endocytic" /t REG_EXPAND_SZ /d "%Nerver% -windowstyle 1 $Farvelaserprintere=(gi 'HKCU:\Software\Goons\').GetValue('Shillingene');%Nerver% ($Farvelaserprintere)"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:216
          • C:\Windows\SysWOW64\reg.exe
            REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Endocytic" /t REG_EXPAND_SZ /d "%Nerver% -windowstyle 1 $Farvelaserprintere=(gi 'HKCU:\Software\Goons\').GetValue('Shillingene');%Nerver% ($Farvelaserprintere)"
            5⤵
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry key
            PID:4784
        • C:\Windows\SysWOW64\msiexec.exe
          C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\gnovtxdzsgspnnodhl"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1740
        • C:\Windows\SysWOW64\msiexec.exe
          C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\qpugupobgokuptchqvsfgl"
          4⤵
            PID:3412
          • C:\Windows\SysWOW64\msiexec.exe
            C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\qpugupobgokuptchqvsfgl"
            4⤵
            • Accesses Microsoft Outlook accounts
            • System Location Discovery: System Language Discovery
            PID:4236
          • C:\Windows\SysWOW64\msiexec.exe
            C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\bjhyuhyuuwdzahylhgfzryorc"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:756

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lvtfgpxd.vh3.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\gnovtxdzsgspnnodhl

      Filesize

      4KB

      MD5

      562a58578d6d04c7fb6bda581c57c03c

      SHA1

      12ab2b88624d01da0c5f5d1441aa21cbc276c5f5

      SHA256

      ff5c70287ba432a83f9015209d6e933462edca01d68c53c09882e1e4d22241c8

      SHA512

      3f6e19faa0196bd4c085defa587e664abdd63c25ef30df8f4323e60a5a5aca3cd2709466f772e64ab00fe331d4264841422d6057451947f3500e9252a132254e

    • C:\Users\Admin\AppData\Local\reguladetriens\Frygts\Udflippedes47\Aimore.Unv

      Filesize

      335KB

      MD5

      a76b3c738bef91dc0872c4a6e676a263

      SHA1

      54e8678dc5eb402dd566eef02d532c5d0825dedf

      SHA256

      eef8c4345d818a1342852abb0d4d6368ba73ebedf356f006fdce15d4aaa4db06

      SHA512

      4d59189a9280e0dc32ba54bd7ce69c6e13ef5409d8144969db1ad878a44f0bd1e1bf8c829570795b127b176341c169bb7ed6b2941c7898702c02a6ba63b33ab2

    • C:\Users\Admin\AppData\Local\reguladetriens\Frygts\Udflippedes47\Kumisses.Ins

      Filesize

      67KB

      MD5

      69242911187aa790800554e0d94ba83e

      SHA1

      8da0aa4b2ab429f6882d2f8a25c33f5f41fa2457

      SHA256

      e52eb097dc1b37cee9dd34c1f15aea34e13855ac37bfc324b24ca91ac2a425ea

      SHA512

      177078b3f88082d16e6d03231db7f002eaf5b16f5384f823f0b914d28a82a2d9bd28ddef63c35d18383a471bbf320e20881a7ba8c68146cc0ffb0f3806ef71a5

    • memory/756-88-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/756-83-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/756-89-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/1740-90-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/1740-87-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/1740-85-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/1740-81-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/2384-100-0x0000000021510000-0x0000000021529000-memory.dmp

      Filesize

      100KB

    • memory/2384-101-0x0000000021510000-0x0000000021529000-memory.dmp

      Filesize

      100KB

    • memory/2384-97-0x0000000021510000-0x0000000021529000-memory.dmp

      Filesize

      100KB

    • memory/2384-73-0x00000000006B0000-0x0000000001904000-memory.dmp

      Filesize

      18.3MB

    • memory/4236-84-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB

    • memory/4236-91-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB

    • memory/4236-82-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB

    • memory/4824-54-0x0000000007A20000-0x0000000007A28000-memory.dmp

      Filesize

      32KB

    • memory/4824-64-0x00000000735A0000-0x0000000073D50000-memory.dmp

      Filesize

      7.7MB

    • memory/4824-44-0x0000000007830000-0x000000000784E000-memory.dmp

      Filesize

      120KB

    • memory/4824-45-0x00000000735A0000-0x0000000073D50000-memory.dmp

      Filesize

      7.7MB

    • memory/4824-47-0x0000000007860000-0x0000000007903000-memory.dmp

      Filesize

      652KB

    • memory/4824-48-0x00000000735A0000-0x0000000073D50000-memory.dmp

      Filesize

      7.7MB

    • memory/4824-46-0x00000000735A0000-0x0000000073D50000-memory.dmp

      Filesize

      7.7MB

    • memory/4824-49-0x0000000007980000-0x000000000798A000-memory.dmp

      Filesize

      40KB

    • memory/4824-50-0x00000000079A0000-0x00000000079B1000-memory.dmp

      Filesize

      68KB

    • memory/4824-51-0x00000000079E0000-0x00000000079EE000-memory.dmp

      Filesize

      56KB

    • memory/4824-52-0x00000000079F0000-0x0000000007A04000-memory.dmp

      Filesize

      80KB

    • memory/4824-53-0x0000000008140000-0x000000000815A000-memory.dmp

      Filesize

      104KB

    • memory/4824-7-0x00000000735AE000-0x00000000735AF000-memory.dmp

      Filesize

      4KB

    • memory/4824-55-0x0000000008140000-0x000000000816A000-memory.dmp

      Filesize

      168KB

    • memory/4824-56-0x0000000008170000-0x0000000008194000-memory.dmp

      Filesize

      144KB

    • memory/4824-57-0x00000000735A0000-0x0000000073D50000-memory.dmp

      Filesize

      7.7MB

    • memory/4824-59-0x00000000735AE000-0x00000000735AF000-memory.dmp

      Filesize

      4KB

    • memory/4824-60-0x00000000735A0000-0x0000000073D50000-memory.dmp

      Filesize

      7.7MB

    • memory/4824-61-0x00000000735A0000-0x0000000073D50000-memory.dmp

      Filesize

      7.7MB

    • memory/4824-34-0x000000006FA30000-0x000000006FA7C000-memory.dmp

      Filesize

      304KB

    • memory/4824-63-0x00000000735A0000-0x0000000073D50000-memory.dmp

      Filesize

      7.7MB

    • memory/4824-33-0x00000000077F0000-0x0000000007822000-memory.dmp

      Filesize

      200KB

    • memory/4824-65-0x00000000735A0000-0x0000000073D50000-memory.dmp

      Filesize

      7.7MB

    • memory/4824-66-0x0000000008CF0000-0x000000000C77D000-memory.dmp

      Filesize

      58.6MB

    • memory/4824-67-0x00000000735A0000-0x0000000073D50000-memory.dmp

      Filesize

      7.7MB

    • memory/4824-68-0x00000000735A0000-0x0000000073D50000-memory.dmp

      Filesize

      7.7MB

    • memory/4824-69-0x00000000735A0000-0x0000000073D50000-memory.dmp

      Filesize

      7.7MB

    • memory/4824-71-0x00000000735A0000-0x0000000073D50000-memory.dmp

      Filesize

      7.7MB

    • memory/4824-72-0x00000000735A0000-0x0000000073D50000-memory.dmp

      Filesize

      7.7MB

    • memory/4824-32-0x0000000008670000-0x0000000008CEA000-memory.dmp

      Filesize

      6.5MB

    • memory/4824-30-0x0000000007A40000-0x0000000007FE4000-memory.dmp

      Filesize

      5.6MB

    • memory/4824-29-0x0000000006940000-0x0000000006962000-memory.dmp

      Filesize

      136KB

    • memory/4824-28-0x0000000006920000-0x000000000693A000-memory.dmp

      Filesize

      104KB

    • memory/4824-27-0x0000000007390000-0x0000000007426000-memory.dmp

      Filesize

      600KB

    • memory/4824-26-0x0000000006460000-0x00000000064AC000-memory.dmp

      Filesize

      304KB

    • memory/4824-25-0x00000000063B0000-0x00000000063CE000-memory.dmp

      Filesize

      120KB

    • memory/4824-24-0x0000000005DD0000-0x0000000006124000-memory.dmp

      Filesize

      3.3MB

    • memory/4824-14-0x0000000005D60000-0x0000000005DC6000-memory.dmp

      Filesize

      408KB

    • memory/4824-13-0x0000000005CF0000-0x0000000005D56000-memory.dmp

      Filesize

      408KB

    • memory/4824-11-0x00000000735A0000-0x0000000073D50000-memory.dmp

      Filesize

      7.7MB

    • memory/4824-12-0x00000000053B0000-0x00000000053D2000-memory.dmp

      Filesize

      136KB

    • memory/4824-10-0x00000000055C0000-0x0000000005BE8000-memory.dmp

      Filesize

      6.2MB

    • memory/4824-9-0x00000000735A0000-0x0000000073D50000-memory.dmp

      Filesize

      7.7MB

    • memory/4824-8-0x0000000004DA0000-0x0000000004DD6000-memory.dmp

      Filesize

      216KB