modiloader | fee06f1a31cdd93b91bf8d0a5991023b2bf6d0ed2957c3bc0f40f05609eb689b

General

Target

d5852dca87eaa4df0cf21616a30be33b.exe
Size

617KB
MD5

d5852dca87eaa4df0cf21616a30be33b
SHA1

895f766ba9cf537ba5446e5482046e88fe4a7e10
SHA256

fee06f1a31cdd93b91bf8d0a5991023b2bf6d0ed2957c3bc0f40f05609eb689b
SHA512

2b691a7e356a395b772198006e87cbfcf9b807ec0d0e0e8ac7c300e3a6f5a7653a9c05ca484f1b1fbf6f0f8f968f6dc6659e4674122ea6f7dc797bd45de889da

Score

10^/10

modiloader remcos persistence rat trojan

Malware Config

Extracted

Family

remcos

C2

official.myq-see.com:2310

official.ydns.eu:2310

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

d5852dca87eaa4df0cf21616a30be33b.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\Nsrgar = "C:\\Users\\Public\\Libraries\\ragrsN.url"	d5852dca87eaa4df0cf21616a30be33b.exe

Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 4 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

ieinstal.exe

pid process

1728 ieinstal.exe

description	flow	ioc
HTTP User-Agent header	4	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

pid	process
1728	ieinstal.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

d5852dca87eaa4df0cf21616a30be33b.exe

description	pid	process	target process
PID 1656 wrote to memory of 1728	1656	d5852dca87eaa4df0cf21616a30be33b.exe	ieinstal.exe
PID 1656 wrote to memory of 1728	1656	d5852dca87eaa4df0cf21616a30be33b.exe	ieinstal.exe
PID 1656 wrote to memory of 1728	1656	d5852dca87eaa4df0cf21616a30be33b.exe	ieinstal.exe
PID 1656 wrote to memory of 1728	1656	d5852dca87eaa4df0cf21616a30be33b.exe	ieinstal.exe
PID 1656 wrote to memory of 1728	1656	d5852dca87eaa4df0cf21616a30be33b.exe	ieinstal.exe
PID 1656 wrote to memory of 1728	1656	d5852dca87eaa4df0cf21616a30be33b.exe	ieinstal.exe
PID 1656 wrote to memory of 1728	1656	d5852dca87eaa4df0cf21616a30be33b.exe	ieinstal.exe
PID 1656 wrote to memory of 1728	1656	d5852dca87eaa4df0cf21616a30be33b.exe	ieinstal.exe
PID 1656 wrote to memory of 1728	1656	d5852dca87eaa4df0cf21616a30be33b.exe	ieinstal.exe
PID 1656 wrote to memory of 1728	1656	d5852dca87eaa4df0cf21616a30be33b.exe	ieinstal.exe
PID 1656 wrote to memory of 1728	1656	d5852dca87eaa4df0cf21616a30be33b.exe	ieinstal.exe
PID 1656 wrote to memory of 1728	1656	d5852dca87eaa4df0cf21616a30be33b.exe	ieinstal.exe
PID 1656 wrote to memory of 1728	1656	d5852dca87eaa4df0cf21616a30be33b.exe	ieinstal.exe
PID 1656 wrote to memory of 1728	1656	d5852dca87eaa4df0cf21616a30be33b.exe	ieinstal.exe
PID 1656 wrote to memory of 1728	1656	d5852dca87eaa4df0cf21616a30be33b.exe	ieinstal.exe
PID 1656 wrote to memory of 1728	1656	d5852dca87eaa4df0cf21616a30be33b.exe	ieinstal.exe
PID 1656 wrote to memory of 1728	1656	d5852dca87eaa4df0cf21616a30be33b.exe	ieinstal.exe
PID 1656 wrote to memory of 1728	1656	d5852dca87eaa4df0cf21616a30be33b.exe	ieinstal.exe
PID 1656 wrote to memory of 1728	1656	d5852dca87eaa4df0cf21616a30be33b.exe	ieinstal.exe

C:\Users\Admin\AppData\Local\Temp\d5852dca87eaa4df0cf21616a30be33b.exe
"C:\Users\Admin\AppData\Local\Temp\d5852dca87eaa4df0cf21616a30be33b.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1656

C:\Program Files (x86)\internet explorer\ieinstal.exe
"C:\Program Files (x86)\internet explorer\ieinstal.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:1728

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1656-2-0x00000000765A1000-0x00000000765A3000-memory.dmp

Filesize
8KB

Download
memory/1656-3-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1728-4-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/1728-5-0x0000000000000000-mapping.dmp

Download
memory/1728-6-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/1728-8-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/1728-14-0x0000000010590000-0x000000001060B000-memory.dmp

Filesize
492KB

Download
memory/1728-15-0x00000000002B0000-0x0000000000328000-memory.dmp

Filesize
480KB

Download

Analysis

Sharing