modiloader | 82fc93baeea70f5e1c60ea976212b5cd2a33402ede66cd0efb059eaa5fae8150

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
08/04/2022, 09:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cff2dff5a3fa3a1c50a43b60d5274a17.exe
Size 1.0MB
Sample220408-ltyb1abge6
SHA256 82fc93baeea70f5e1c60ea976212b5cd2a33402ede66cd0efb059eaa5fae8150
MD5 cff2dff5a3fa3a1c50a43b60d5274a17
SHA1 b768dd66b4da763222dc118c395b5dd66593cdd3
SHA512 91a5d475a6fd29df9f949976242fc7e85a161cc298bceee4b7bc05d7b9dfd2d35298ec5698da033cf861a5ea7997bfb8d7dbb507d5d2a697a259d891c5dee94f
MD5 SHA1 SHA512

Score

10^/10

modiloader remcos 04072022 persistence rat trojan

Malware Config

Extracted

Family

remcos

Botnet

04072022

nikahuve.ac.ug:6968
kalskala.ac.ug:6968
tuekisaa.ac.ug:6968
parthaha.ac.ug:6968

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
install_path
%AppData%
keylog_crypt
true
keylog_file
scxs.dat
keylog_flag
false
keylog_folder
forbas
keylog_path
%AppData%
mouse_option
false
mutex
cvxyttydfsgbghfgfhtd-1SHE5V
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hktrscw = "C:\\Users\\Public\\Libraries\\wcsrtkH.url"	cff2dff5a3fa3a1c50a43b60d5274a17.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4124	powershell.exe
4124	powershell.exe
4124	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4124	powershell.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3196 wrote to memory of 812	3196	cff2dff5a3fa3a1c50a43b60d5274a17.exe	91
PID 3196 wrote to memory of 812	3196	cff2dff5a3fa3a1c50a43b60d5274a17.exe	91
PID 3196 wrote to memory of 812	3196	cff2dff5a3fa3a1c50a43b60d5274a17.exe	91
PID 812 wrote to memory of 2576	812	cmd.exe	93
PID 812 wrote to memory of 2576	812	cmd.exe	93
PID 812 wrote to memory of 2576	812	cmd.exe	93
PID 2576 wrote to memory of 4028	2576	cmd.exe	95
PID 2576 wrote to memory of 4028	2576	cmd.exe	95
PID 2576 wrote to memory of 4028	2576	cmd.exe	95
PID 4028 wrote to memory of 4100	4028	net.exe	96
PID 4028 wrote to memory of 4100	4028	net.exe	96
PID 4028 wrote to memory of 4100	4028	net.exe	96
PID 2576 wrote to memory of 4124	2576	cmd.exe	97
PID 2576 wrote to memory of 4124	2576	cmd.exe	97
PID 2576 wrote to memory of 4124	2576	cmd.exe	97
PID 3196 wrote to memory of 4588	3196	cff2dff5a3fa3a1c50a43b60d5274a17.exe	102
PID 3196 wrote to memory of 4588	3196	cff2dff5a3fa3a1c50a43b60d5274a17.exe	102
PID 3196 wrote to memory of 4588	3196	cff2dff5a3fa3a1c50a43b60d5274a17.exe	102
PID 3196 wrote to memory of 4588	3196	cff2dff5a3fa3a1c50a43b60d5274a17.exe	102
PID 3196 wrote to memory of 4588	3196	cff2dff5a3fa3a1c50a43b60d5274a17.exe	102
PID 3196 wrote to memory of 4588	3196	cff2dff5a3fa3a1c50a43b60d5274a17.exe	102
PID 3196 wrote to memory of 4588	3196	cff2dff5a3fa3a1c50a43b60d5274a17.exe	102
PID 3196 wrote to memory of 4588	3196	cff2dff5a3fa3a1c50a43b60d5274a17.exe	102
PID 3196 wrote to memory of 4588	3196	cff2dff5a3fa3a1c50a43b60d5274a17.exe	102
PID 3196 wrote to memory of 4588	3196	cff2dff5a3fa3a1c50a43b60d5274a17.exe	102
PID 3196 wrote to memory of 4588	3196	cff2dff5a3fa3a1c50a43b60d5274a17.exe	102
PID 3196 wrote to memory of 4588	3196	cff2dff5a3fa3a1c50a43b60d5274a17.exe	102
PID 3196 wrote to memory of 4588	3196	cff2dff5a3fa3a1c50a43b60d5274a17.exe	102
PID 3196 wrote to memory of 4588	3196	cff2dff5a3fa3a1c50a43b60d5274a17.exe	102
PID 3196 wrote to memory of 4588	3196	cff2dff5a3fa3a1c50a43b60d5274a17.exe	102

C:\Users\Admin\AppData\Local\Temp\cff2dff5a3fa3a1c50a43b60d5274a17.exe
"C:\Users\Admin\AppData\Local\Temp\cff2dff5a3fa3a1c50a43b60d5274a17.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\Hktrscwt.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:812
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Public\Libraries\HktrscwO.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\Windows\SysWOW64\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4028
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:4100
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4124
- C:\Windows\SysWOW64\DpiScaling.exe
  C:\Windows\System32\DpiScaling.exe
  2⤵
  PID:4588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:4132

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Cdex.bat

Path C:\Users\Public\Libraries\Cdex.bat
Size 155B
SHA256 37c59c8398279916cfce45f8c5e3431058248f5e3bef4d9f5c0f44a7d564f82e
MD5 213c60adf1c9ef88dc3c9b2d579959d2
SHA1 e4d2ad7b22b1a8b5b1f7a702b303c7364b0ee021
SHA512 fe897d9caa306b0e761b2fd61bb5dc32a53bfaad1ce767c6860af4e3ad59c8f3257228a6e1072dab0f990cb51c59c648084ba419ac6bc5c0a99bdffa569217b7
MD5 SHA1 SHA512

Submit Download

HktrscwO.bat

Path C:\Users\Public\Libraries\HktrscwO.bat
Size 1KB
SHA256 4ef9821678da07138c19405387f3fb95e409fbd461c7b8d847c05075facd63ca
MD5 df48c09f243ebcc8a165f77a1c2bf889
SHA1 455f7db0adcc2a58d006f1630fb0bd55cd868c07
SHA512 735838c7cca953697ded48adfcd037b7f198072a8962f5940ce12e1bb1c7dd8c1f257a829276f5f5456f776f5bd13342222dd6e0dfc8f18a23f464f2c8d8f1cc
MD5 SHA1 SHA512

Submit Download

Hktrscwt.bat

Path C:\Users\Public\Libraries\Hktrscwt.bat
Size 56B
SHA256 41188fa8de540f6e143b33bf11921fa7b5b4f1175e8a53fafae3cbbc42b6be51
MD5 04200495011c4b5bde44c79b4637a1d6
SHA1 74c78720f9d413612d29bb04d9b3150011c27b8d
SHA512 bfb8f31f69c9221718570d47ec10a03ec7384df8ab9f452cdf615eaa63011e0f85954de26377641842d182097f1fd2763ed7d43893e8a42ad501090d4649e153
MD5 SHA1 SHA512

Submit Download

memory/4124-156-0x0000000002925000-0x0000000002927000-memory.dmp

Download

memory/4124-160-0x00000000076C0000-0x0000000007D3A000-memory.dmp

Download

memory/4124-151-0x0000000004FD0000-0x00000000055F8000-memory.dmp

Download

memory/4124-152-0x0000000004F50000-0x0000000004F72000-memory.dmp

Download

memory/4124-153-0x0000000005670000-0x00000000056D6000-memory.dmp

Download

memory/4124-154-0x00000000056E0000-0x0000000005746000-memory.dmp

Download

memory/4124-155-0x0000000005D10000-0x0000000005D2E000-memory.dmp

Download

memory/4124-157-0x00000000062B0000-0x00000000062E2000-memory.dmp

Download

memory/4124-158-0x000000006FE40000-0x000000006FE8C000-memory.dmp

Download

memory/4124-159-0x0000000004AC0000-0x0000000004ADE000-memory.dmp

Download

memory/4124-150-0x0000000002840000-0x0000000002876000-memory.dmp

Download

memory/4124-161-0x0000000006F50000-0x0000000006F6A000-memory.dmp

Download

memory/4124-162-0x0000000007090000-0x000000000709A000-memory.dmp

Download

memory/4124-163-0x0000000007280000-0x0000000007316000-memory.dmp

Download

memory/4124-169-0x0000000007330000-0x0000000007338000-memory.dmp

Download

memory/4124-168-0x0000000007340000-0x000000000735A000-memory.dmp

Download

memory/4124-167-0x0000000007240000-0x000000000724E000-memory.dmp

Download

memory/4588-166-0x0000000000930000-0x00000000009AA000-memory.dmp

Download

memory/4588-165-0x0000000010590000-0x000000001060D000-memory.dmp

Download