Overview

overview

10

Static

static

162369ef2e...f6.exe

windows7_x64

10

162369ef2e...f6.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6

  • Size

    597KB

  • Sample

    220609-fexh9schaq

  • MD5

    419bf8b9f950bbf4e89cdde4de7601b9

  • SHA1

    a2e7419f565599a74b41e041175ce240677581a4

  • SHA256

    162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6

  • SHA512

    bea432937e909a1aa57ee1ce1194b98bc3ac0d16c5ff76cbc783c363af4cf0a9b1e848fa6e7307725818a47a5f2686b152507519b636c4514ea2ed7c7602dc9f

Score
10/10
remcosmodzillaloadpersistencerat

Malware Config

Extracted

Family

remcos

Version

2.0.3 Pro

Botnet

modzillaload

C2

hhlari.ddns.net:5001

Attributes
  • audio_folder

    audio

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    5

  • copy_file

    modzillaload.exe

  • copy_folder

    modzillaload

  • delete_file

    true

  • hide_file

    true

  • hide_keylog_file

    true

  • install_flag

    true

  • install_path

    %AppData%

  • keylog_crypt

    true

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    workload

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    workload-FM1X2V

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    modzillaload

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

Targets

    • Target

      162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6

    • Size

      597KB

    • MD5

      419bf8b9f950bbf4e89cdde4de7601b9

    • SHA1

      a2e7419f565599a74b41e041175ce240677581a4

    • SHA256

      162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6

    • SHA512

      bea432937e909a1aa57ee1ce1194b98bc3ac0d16c5ff76cbc783c363af4cf0a9b1e848fa6e7307725818a47a5f2686b152507519b636c4514ea2ed7c7602dc9f

    Score
    10/10
    remcosmodzillaloadpersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks