modiloader | 896d2dc1eab72419ab524333d3fba88c8ddf92b087f1c9af5d6ea402b0c77d89

General

Target

Document.exe
Size

845KB
MD5

26382b4f3cc97798992f8c88c27febdd
SHA1

7e8971f121c2b09dea8760c1f1edc5b9931d24f8
SHA256

896d2dc1eab72419ab524333d3fba88c8ddf92b087f1c9af5d6ea402b0c77d89
SHA512

a15fb1bf882f23359fb86ec59fee5bc1fb2b7b0059550842c2d27489788834b843ca81ff0252d9b6359dbf9cd572bed9b65447a82571b3067b0515143d299b07

Score

10^/10

modiloader remcos persistence rat trojan

Malware Config

Extracted

Family

remcos

C2

Bruno.camdvr.org:2404

Bruno1.camdvr.org:2404

Bruno2.camdvr.org:2404

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Document.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Emtgcw = "C:\\Users\\Public\\Libraries\\wcgtmE.url"	Document.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

ieinstal.exe

pid process

2452 ieinstal.exe

pid	process
2452	ieinstal.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Document.exe

description	pid	process	target process
PID 1032 wrote to memory of 2452	1032	Document.exe	ieinstal.exe
PID 1032 wrote to memory of 2452	1032	Document.exe	ieinstal.exe
PID 1032 wrote to memory of 2452	1032	Document.exe	ieinstal.exe
PID 1032 wrote to memory of 2452	1032	Document.exe	ieinstal.exe
PID 1032 wrote to memory of 2452	1032	Document.exe	ieinstal.exe
PID 1032 wrote to memory of 2452	1032	Document.exe	ieinstal.exe
PID 1032 wrote to memory of 2452	1032	Document.exe	ieinstal.exe
PID 1032 wrote to memory of 2452	1032	Document.exe	ieinstal.exe
PID 1032 wrote to memory of 2452	1032	Document.exe	ieinstal.exe
PID 1032 wrote to memory of 2452	1032	Document.exe	ieinstal.exe
PID 1032 wrote to memory of 2452	1032	Document.exe	ieinstal.exe
PID 1032 wrote to memory of 2452	1032	Document.exe	ieinstal.exe
PID 1032 wrote to memory of 2452	1032	Document.exe	ieinstal.exe
PID 1032 wrote to memory of 2452	1032	Document.exe	ieinstal.exe
PID 1032 wrote to memory of 2452	1032	Document.exe	ieinstal.exe

C:\Users\Admin\AppData\Local\Temp\Document.exe
"C:\Users\Admin\AppData\Local\Temp\Document.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1032

C:\Program Files (x86)\internet explorer\ieinstal.exe
"C:\Program Files (x86)\internet explorer\ieinstal.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:2452

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1032-2-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/1032-3-0x0000000002480000-0x000000000249A000-memory.dmp

Filesize
104KB

Download
memory/2452-5-0x0000000000000000-mapping.dmp

Download
memory/2452-4-0x0000000002F60000-0x0000000002F61000-memory.dmp

Filesize
4KB

Download
memory/2452-6-0x0000000003220000-0x0000000003221000-memory.dmp

Filesize
4KB

Download
memory/2452-8-0x0000000002FC0000-0x0000000002FC1000-memory.dmp

Filesize
4KB

Download
memory/2452-14-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2452-13-0x0000000010590000-0x000000001060C000-memory.dmp

Filesize
496KB

Download

Analysis

Sharing