modiloader | 9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0

General

Target

9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe
Size

641KB
MD5

639c95bf1667588ce5a79091ba39adf0
SHA1

7522d42148f911649f8e6cbc77e15e03fe65adfb
SHA256

9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0
SHA512

ceb93e8e0322ba90f287f5871f2d7049dde5381130695c6f35362c4866b832335709c0fe1a90aa21140b16ebb8579e4f67c78100e5ca4f0e8857da06b34b3e1e

Score

10^/10

modiloader remcos xxxxxxxxxxx persistence rat trojan

Malware Config

Extracted

Family

remcos

Version

2.7.1 Light

Botnet

xxxxxxxxxxx

C2

perrymason.ac.ug:6969

macapslafg.ug:6969

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
cvxdsaxzcas-C19IL8
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

ModiLoader First Stage 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2820-131-0x00000000027D0000-0x00000000027DF000-memory.dmp	modiloader_stage1

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Uvzm = "C:\\Users\\Admin\\AppData\\Local\\mzvU.url"	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Modifies registry key 1 TTPs 3 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exereg.exe

pid process

4736 reg.exe
404 reg.exe
2124 reg.exe

pid	process
4736	reg.exe
404	reg.exe
2124	reg.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe

description	pid	process	target process
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe
PID 2820 wrote to memory of 380	2820	9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe	Notepad.exe

C:\Users\Admin\AppData\Local\Temp\9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe
"C:\Users\Admin\AppData\Local\Temp\9ecb7be2270613d25c75a8314a766ac0ca179cd9f13555ea6746485c4ca0d4f0.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2820

C:\Windows\SysWOW64\Notepad.exe
"C:\Windows\System32\Notepad.exe"
2⤵
PID:380

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Public\Natso.bat
3⤵
PID:5076

C:\Windows\SysWOW64\reg.exe
reg delete hkcu\Environment /v windir /f
4⤵
- Modifies registry key
PID:2124

C:\Windows\SysWOW64\reg.exe
reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\x.bat reg delete hkcu\Environment /v windir /f && REM "
4⤵
- Modifies registry key
PID:4736

C:\Windows\SysWOW64\schtasks.exe
schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
4⤵
PID:2540

C:\Windows\SysWOW64\reg.exe
reg delete hkcu\Environment /v windir /f
4⤵
- Modifies registry key
PID:404

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Public\Natso.bat
3⤵
PID:4724

C:\Program Files (x86)\internet explorer\ieinstal.exe
"C:\Program Files (x86)\internet explorer\ieinstal.exe"
2⤵
PID:736

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Natso.bat
Filesize
283B

MD5
5cc1682955fd9f5800a8f1530c9a4334

SHA1
e09b6a4d729f2f4760ee42520ec30c3192c85548

SHA256
5562cc607d2f698327efacc4a21bd079bb14a99b03e7a01b3c67f8440e341cb3

SHA512
80767263aad44c739236161d4338d5dd8b0b58613f22cd173c3e88ebf143220ee56bbf93ace69a07d3c2f00daff0adbaa8461a1d53d12699725395c931c43cb6

Download Submit
memory/380-137-0x0000000000000000-mapping.dmp

Download
memory/380-145-0x0000000050480000-0x000000005049A000-memory.dmp

Filesize
104KB

Download
memory/404-144-0x0000000000000000-mapping.dmp

Download
memory/736-139-0x0000000000000000-mapping.dmp

Download
memory/736-146-0x0000000010530000-0x000000001054B000-memory.dmp

Filesize
108KB

Download
memory/736-147-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2124-141-0x0000000000000000-mapping.dmp

Download
memory/2540-143-0x0000000000000000-mapping.dmp

Download
memory/2820-131-0x00000000027D0000-0x00000000027DF000-memory.dmp

Filesize
60KB

Download
memory/4724-148-0x0000000000000000-mapping.dmp

Download
memory/4736-142-0x0000000000000000-mapping.dmp

Download
memory/5076-138-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads