Overview

overview

10

Static

static

6d238a412f...16.rtf

windows7_x64

10

6d238a412f...16.rtf

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6d238a412f808d2c4c56865d7f4c4d16.rtf

  • Size

    11KB

  • Sample

    210119-eg8xz9yzej

  • MD5

    6d238a412f808d2c4c56865d7f4c4d16

  • SHA1

    cf2c952dd7303167d7e666763dcf278088190f52

  • SHA256

    a4ab58cc18771c7141e96d45714b7aeb046ff7173ec5266f08da7b28d411744e

  • SHA512

    764bc68ac1f55d2b0b717ec8434f22c8bc5baf50cfa517e8d0fbae22f2419332d33f67d5dc41bab415e5e68af9b42c41df8262f25ea105f65c4984e8c5c3fbe8

Score
10/10
modiloaderremcospersistencerattrojan

Malware Config

Extracted

Family

remcos

C2

4sureme.ddns.net:4902

Targets

    • Target

      6d238a412f808d2c4c56865d7f4c4d16.rtf

    • Size

      11KB

    • MD5

      6d238a412f808d2c4c56865d7f4c4d16

    • SHA1

      cf2c952dd7303167d7e666763dcf278088190f52

    • SHA256

      a4ab58cc18771c7141e96d45714b7aeb046ff7173ec5266f08da7b28d411744e

    • SHA512

      764bc68ac1f55d2b0b717ec8434f22c8bc5baf50cfa517e8d0fbae22f2419332d33f67d5dc41bab415e5e68af9b42c41df8262f25ea105f65c4984e8c5c3fbe8

    Score
    10/10
    modiloaderremcospersistencerattrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • ModiLoader First Stage

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

3
T1112

Install Root Certificate

1
T1130

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks