modiloader | 5de615f4ccd588a4baab01f4884effac836334fd116ad1732f7c17560d6f0e8d

General

Target

IMG_7100.scr
Size

869KB
MD5

327916646174b24f42a533053e976e41
SHA1

60884023e12058000563bdb2f302f8fc00d4c83d
SHA256

a800578827b7e3667884f92ab26a58dc3197e3be7730678d84aa3d9bb5d15db3
SHA512

78a980271645839e0e859077c913cef16da4dd4611f5c1e5ce0e5db25b866ff417c22f639b931839e98ccb9cd4914e46c4876b1756c7fc03b7f6f39bca4c9237

Score

10^/10

modiloader remcos remotehost persistence rat trojan

Malware Config

Extracted

Family

remcos

Version

3.3.2 Pro

Botnet

RemoteHost

C2

proprapra90.ddns.net:8810

storeyman7109.duckdns.org:8810

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
morethan-CJ2X2C
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

ModiLoader First Stage 7 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1920-57-0x00000000003E0000-0x00000000003FB000-memory.dmp	modiloader_stage1
behavioral1/memory/1920-66-0x00000000003E0000-0x00000000003FB000-memory.dmp	modiloader_stage1
behavioral1/memory/1920-65-0x00000000003E0000-0x00000000003FB000-memory.dmp	modiloader_stage1
behavioral1/memory/1920-64-0x00000000003E0000-0x00000000003FB000-memory.dmp	modiloader_stage1
behavioral1/memory/1920-63-0x00000000003E0000-0x00000000003FB000-memory.dmp	modiloader_stage1
behavioral1/memory/1920-62-0x00000000003E0000-0x00000000003FB000-memory.dmp	modiloader_stage1
behavioral1/memory/1920-61-0x00000000003E0000-0x00000000003FB000-memory.dmp	modiloader_stage1

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

IMG_7100.scr

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\Lvughbdemq = "C:\\Users\\Admin\\Contacts\\qmedbhguvL.url"	IMG_7100.scr

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

IMG_7100.scr

description	pid	process	target process
PID 1920 wrote to memory of 656	1920	IMG_7100.scr	logagent.exe
PID 1920 wrote to memory of 656	1920	IMG_7100.scr	logagent.exe
PID 1920 wrote to memory of 656	1920	IMG_7100.scr	logagent.exe
PID 1920 wrote to memory of 656	1920	IMG_7100.scr	logagent.exe
PID 1920 wrote to memory of 656	1920	IMG_7100.scr	logagent.exe
PID 1920 wrote to memory of 656	1920	IMG_7100.scr	logagent.exe
PID 1920 wrote to memory of 656	1920	IMG_7100.scr	logagent.exe
PID 1920 wrote to memory of 656	1920	IMG_7100.scr	logagent.exe
PID 1920 wrote to memory of 656	1920	IMG_7100.scr	logagent.exe
PID 1920 wrote to memory of 656	1920	IMG_7100.scr	logagent.exe
PID 1920 wrote to memory of 656	1920	IMG_7100.scr	logagent.exe
PID 1920 wrote to memory of 656	1920	IMG_7100.scr	logagent.exe
PID 1920 wrote to memory of 656	1920	IMG_7100.scr	logagent.exe
PID 1920 wrote to memory of 656	1920	IMG_7100.scr	logagent.exe
PID 1920 wrote to memory of 656	1920	IMG_7100.scr	logagent.exe
PID 1920 wrote to memory of 656	1920	IMG_7100.scr	logagent.exe

C:\Users\Admin\AppData\Local\Temp\IMG_7100.scr
"C:\Users\Admin\AppData\Local\Temp\IMG_7100.scr" /S
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1920

C:\Windows\SysWOW64\logagent.exe
C:\Windows\System32\logagent.exe
2⤵
PID:656

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/656-70-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/656-88-0x00000000002E0000-0x000000000035B000-memory.dmp

Filesize
492KB

Download
memory/656-87-0x0000000072600000-0x000000007267E000-memory.dmp

Filesize
504KB

Download
memory/656-86-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/656-84-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/656-85-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/656-80-0x0000000072600000-0x000000007267E000-memory.dmp

Filesize
504KB

Download
memory/1920-65-0x00000000003E0000-0x00000000003FB000-memory.dmp

Filesize
108KB

Download
memory/1920-61-0x00000000003E0000-0x00000000003FB000-memory.dmp

Filesize
108KB

Download
memory/1920-62-0x00000000003E0000-0x00000000003FB000-memory.dmp

Filesize
108KB

Download
memory/1920-63-0x00000000003E0000-0x00000000003FB000-memory.dmp

Filesize
108KB

Download
memory/1920-64-0x00000000003E0000-0x00000000003FB000-memory.dmp

Filesize
108KB

Download
memory/1920-54-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/1920-66-0x00000000003E0000-0x00000000003FB000-memory.dmp

Filesize
108KB

Download
memory/1920-57-0x00000000003E0000-0x00000000003FB000-memory.dmp

Filesize
108KB

Download
memory/1920-55-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads