modiloader | a030c2bf64a9ee2737aca5e34c9c89fa34c16ed61b16af1f0b9a8455fd6f4b1f

General

Target

MORCOS OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe
Size

546KB
MD5

72ae4f1b35063e90001879c372dca306
SHA1

1faf15f94b33ca63af933418205ef1b304dcbe94
SHA256

a030c2bf64a9ee2737aca5e34c9c89fa34c16ed61b16af1f0b9a8455fd6f4b1f
SHA512

37c168868e29d4120883d63bc70cfea591bafa10bbb74d209aaeb28ef98ea21b82b64dfe76679a870d1b41c804eaf6c5495397ea6cfc5023b3a33cf7a6885376

Score

10^/10

modiloader remcos persistence rat trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\Npwt = "C:\\Users\\Admin\\AppData\\Local\\Npwt\\Npwt.hta"	MORCOS OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

description	pid	process	target process
PID 3692 wrote to memory of 1004	3692	MORCOS OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe	ieinstal.exe
PID 3692 wrote to memory of 1004	3692	MORCOS OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe	ieinstal.exe
PID 3692 wrote to memory of 1004	3692	MORCOS OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe	ieinstal.exe
PID 3692 wrote to memory of 1004	3692	MORCOS OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe	ieinstal.exe
PID 3692 wrote to memory of 1004	3692	MORCOS OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe	ieinstal.exe
PID 3692 wrote to memory of 1004	3692	MORCOS OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe	ieinstal.exe
PID 3692 wrote to memory of 1004	3692	MORCOS OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe	ieinstal.exe
PID 3692 wrote to memory of 1004	3692	MORCOS OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe	ieinstal.exe
PID 3692 wrote to memory of 1004	3692	MORCOS OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe	ieinstal.exe
PID 3692 wrote to memory of 1004	3692	MORCOS OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe	ieinstal.exe
PID 3692 wrote to memory of 1004	3692	MORCOS OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe	ieinstal.exe
PID 3692 wrote to memory of 1004	3692	MORCOS OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe	ieinstal.exe
PID 3692 wrote to memory of 1004	3692	MORCOS OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe	ieinstal.exe
PID 3692 wrote to memory of 1004	3692	MORCOS OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe	ieinstal.exe
PID 3692 wrote to memory of 1004	3692	MORCOS OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe	ieinstal.exe

C:\Users\Admin\AppData\Local\Temp\MORCOS OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\MORCOS OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3692

C:\Program Files (x86)\internet explorer\ieinstal.exe
"C:\Program Files (x86)\internet explorer\ieinstal.exe"
2⤵
PID:1004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

Web Service

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1004-0-0x0000000000000000-mapping.dmp

Download
memory/1004-1-0x0000000000000000-mapping.dmp

Download
memory/1004-2-0x0000000000000000-mapping.dmp

Download
memory/1004-4-0x0000000000000000-mapping.dmp

Download
memory/3692-3-0x0000000010530000-0x0000000010554000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing