48234a387e7777a7a284acb8f0bfef52.exe

General
Target

48234a387e7777a7a284acb8f0bfef52.exe

Size

637KB

Sample

210408-x16bed3gjn

Score
10 /10
MD5

48234a387e7777a7a284acb8f0bfef52

SHA1

b34a895fe511e36af09231c1239577a565e380e6

SHA256

4a7f380de68e6969bcedffe6c7d5b01ac9ecd1f4df9f2bb79fb7fec94252e095

SHA512

e3f7fefb4ba37baeea23603a9a4c48197efb54495741d613f8eddc58074f8cbe20658406c949fff510730eed8dc000cd61550b7b69e2c668cc43f6b2cb60e546

Malware Config

Extracted

Family remcos
C2

alukoren.duckdns.org:9144

Targets
Target

48234a387e7777a7a284acb8f0bfef52.exe

MD5

48234a387e7777a7a284acb8f0bfef52

Filesize

637KB

Score
10 /10
SHA1

b34a895fe511e36af09231c1239577a565e380e6

SHA256

4a7f380de68e6969bcedffe6c7d5b01ac9ecd1f4df9f2bb79fb7fec94252e095

SHA512

e3f7fefb4ba37baeea23603a9a4c48197efb54495741d613f8eddc58074f8cbe20658406c949fff510730eed8dc000cd61550b7b69e2c668cc43f6b2cb60e546

Tags

Signatures

  • ModiLoader, DBatLoader

    Description

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    Tags

  • Remcos

    Description

    Remcos is a closed-source remote control and surveillance software.

    Tags

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Adds Run key to start application

    Tags

    TTPs

    Registry Run Keys / Startup Folder Modify Registry

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Discovery
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Privilege Escalation
                      Tasks

                      static1

                      behavioral2

                      10/10