Overview

overview

10

Static

static

PO AR483-1...T.xlsx

windows7_x64

10

PO AR483-1...T.xlsx

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PO AR483-1590436 _ J-3000 PROJT.xlsx

  • Size

    55KB

  • Sample

    210119-7qn7537n26

  • MD5

    245fa98d0fc156ccd21c92b31ec8c5c7

  • SHA1

    b5cabd660aafef98fc3fbc987aa1bc4d5884fa17

  • SHA256

    a681967d5d91f1def07dcde80d561b9621381760b781c970746673d53e7bfcd7

  • SHA512

    b78e1f36524ddb9a76d36ee809150bd8cf0f2a0a3ae747d79046e6cb5a14e863485e0740c2a860b7f40be19b70f2607c0cd9f1a753facf8c41d4c7c2cd22c3b7

Score
10/10
modiloaderremcospersistencerattrojan

Malware Config

Extracted

Family

remcos

C2

4sureme.ddns.net:4902

Targets

    • Target

      PO AR483-1590436 _ J-3000 PROJT.xlsx

    • Size

      55KB

    • MD5

      245fa98d0fc156ccd21c92b31ec8c5c7

    • SHA1

      b5cabd660aafef98fc3fbc987aa1bc4d5884fa17

    • SHA256

      a681967d5d91f1def07dcde80d561b9621381760b781c970746673d53e7bfcd7

    • SHA512

      b78e1f36524ddb9a76d36ee809150bd8cf0f2a0a3ae747d79046e6cb5a14e863485e0740c2a860b7f40be19b70f2607c0cd9f1a753facf8c41d4c7c2cd22c3b7

    Score
    10/10
    modiloaderremcospersistencerattrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • ModiLoader First Stage

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Abuses OpenXML format to download file from external location

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

3
T1112

Install Root Certificate

1
T1130

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks