remcos | 162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6

General

Target

162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6.exe
Size

597KB
MD5

419bf8b9f950bbf4e89cdde4de7601b9
SHA1

a2e7419f565599a74b41e041175ce240677581a4
SHA256

162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6
SHA512

bea432937e909a1aa57ee1ce1194b98bc3ac0d16c5ff76cbc783c363af4cf0a9b1e848fa6e7307725818a47a5f2686b152507519b636c4514ea2ed7c7602dc9f

Score

10^/10

remcos modzillaload persistence rat

Malware Config

Extracted

Family

remcos

Version

2.0.3 Pro

Botnet

modzillaload

C2

hhlari.ddns.net:5001

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
modzillaload.exe
copy_folder
modzillaload
delete_file
true
hide_file
true
hide_keylog_file
true
install_flag
true
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
workload
keylog_path
%AppData%
mouse_option
false
mutex
workload-FM1X2V
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
modzillaload
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 2 IoCs

pid	Process
1528	modzillaload.exe
692	modzillaload.exe

Deletes itself 1 IoCs

pid	Process
1872	WScript.exe

Loads dropped DLL 2 IoCs

pid	Process
268	cmd.exe
268	cmd.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\	162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\modzillaload = "\"C:\\Users\\Admin\\AppData\\Roaming\\modzillaload\\modzillaload.exe\""	162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\	modzillaload.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\modzillaload = "\"C:\\Users\\Admin\\AppData\\Roaming\\modzillaload\\modzillaload.exe\""	modzillaload.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 956 set thread context of 2024	956	162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6.exe	28
PID 1528 set thread context of 692	1528	modzillaload.exe	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
956	162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6.exe
1528	modzillaload.exe
692	modzillaload.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2024	162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6.exe
692	modzillaload.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 2024	956	162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6.exe	28
PID 956 wrote to memory of 2024	956	162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6.exe	28
PID 956 wrote to memory of 2024	956	162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6.exe	28
PID 956 wrote to memory of 2024	956	162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6.exe	28
PID 2024 wrote to memory of 1872	2024	162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6.exe	29
PID 2024 wrote to memory of 1872	2024	162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6.exe	29
PID 2024 wrote to memory of 1872	2024	162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6.exe	29
PID 2024 wrote to memory of 1872	2024	162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6.exe	29
PID 1872 wrote to memory of 268	1872	WScript.exe	30
PID 1872 wrote to memory of 268	1872	WScript.exe	30
PID 1872 wrote to memory of 268	1872	WScript.exe	30
PID 1872 wrote to memory of 268	1872	WScript.exe	30
PID 268 wrote to memory of 1528	268	cmd.exe	32
PID 268 wrote to memory of 1528	268	cmd.exe	32
PID 268 wrote to memory of 1528	268	cmd.exe	32
PID 268 wrote to memory of 1528	268	cmd.exe	32
PID 1528 wrote to memory of 692	1528	modzillaload.exe	33
PID 1528 wrote to memory of 692	1528	modzillaload.exe	33
PID 1528 wrote to memory of 692	1528	modzillaload.exe	33
PID 1528 wrote to memory of 692	1528	modzillaload.exe	33

C:\Users\Admin\AppData\Local\Temp\162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6.exe
"C:\Users\Admin\AppData\Local\Temp\162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:956
- C:\Users\Admin\AppData\Local\Temp\162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6.exe
  C:\Users\Admin\AppData\Local\Temp\162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
    3⤵
    - Deletes itself
    - Suspicious use of WriteProcessMemory
    PID:1872
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\modzillaload\modzillaload.exe"
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:268
    - - C:\Users\Admin\AppData\Roaming\modzillaload\modzillaload.exe
        
        C:\Users\Admin\AppData\Roaming\modzillaload\modzillaload.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1528
      - C:\Users\Admin\AppData\Roaming\modzillaload\modzillaload.exe
        
        :\Users\Admin\AppData\Roaming\modzillaload\modzillaload.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetWindowsHookEx
        Suspicious use of UnmapMainImage
        
        PID:692

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.vbs

Filesize
682B

MD5
951370e137d06f35bba436d4d4537edd

SHA1
987c3f0d4efdfeaec51da2e298318bdc58b70a6e

SHA256
5d9071194fa2ff798e678184b8cee4ef17adeb49dfcdc77a7c46ebea3c0510a7

SHA512
075f23f01c624a96490585c8e6bd9aaeb69d3d777710d580050679292271b3590f4164926188990bd7f3cca5ea0b995d2eef3bfacb9d460500a652105e5eeba0

Download Submit
C:\Users\Admin\AppData\Roaming\modzillaload\modzillaload.exe

Filesize
597KB

MD5
419bf8b9f950bbf4e89cdde4de7601b9

SHA1
a2e7419f565599a74b41e041175ce240677581a4

SHA256
162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6

SHA512
bea432937e909a1aa57ee1ce1194b98bc3ac0d16c5ff76cbc783c363af4cf0a9b1e848fa6e7307725818a47a5f2686b152507519b636c4514ea2ed7c7602dc9f

Download Submit
C:\Users\Admin\AppData\Roaming\modzillaload\modzillaload.exe

Filesize
597KB

MD5
419bf8b9f950bbf4e89cdde4de7601b9

SHA1
a2e7419f565599a74b41e041175ce240677581a4

SHA256
162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6

SHA512
bea432937e909a1aa57ee1ce1194b98bc3ac0d16c5ff76cbc783c363af4cf0a9b1e848fa6e7307725818a47a5f2686b152507519b636c4514ea2ed7c7602dc9f

Download Submit
C:\Users\Admin\AppData\Roaming\modzillaload\modzillaload.exe

Filesize
597KB

MD5
419bf8b9f950bbf4e89cdde4de7601b9

SHA1
a2e7419f565599a74b41e041175ce240677581a4

SHA256
162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6

SHA512
bea432937e909a1aa57ee1ce1194b98bc3ac0d16c5ff76cbc783c363af4cf0a9b1e848fa6e7307725818a47a5f2686b152507519b636c4514ea2ed7c7602dc9f

Download Submit
\Users\Admin\AppData\Roaming\modzillaload\modzillaload.exe

Filesize
597KB

MD5
419bf8b9f950bbf4e89cdde4de7601b9

SHA1
a2e7419f565599a74b41e041175ce240677581a4

SHA256
162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6

SHA512
bea432937e909a1aa57ee1ce1194b98bc3ac0d16c5ff76cbc783c363af4cf0a9b1e848fa6e7307725818a47a5f2686b152507519b636c4514ea2ed7c7602dc9f

Download Submit
\Users\Admin\AppData\Roaming\modzillaload\modzillaload.exe

Filesize
597KB

MD5
419bf8b9f950bbf4e89cdde4de7601b9

SHA1
a2e7419f565599a74b41e041175ce240677581a4

SHA256
162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6

SHA512
bea432937e909a1aa57ee1ce1194b98bc3ac0d16c5ff76cbc783c363af4cf0a9b1e848fa6e7307725818a47a5f2686b152507519b636c4514ea2ed7c7602dc9f

Download Submit
memory/692-85-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/692-88-0x0000000077700000-0x0000000077880000-memory.dmp

Filesize
1.5MB

Download
memory/956-56-0x00000000003D0000-0x00000000003D7000-memory.dmp

Filesize
28KB

Download
memory/956-59-0x0000000077700000-0x0000000077880000-memory.dmp

Filesize
1.5MB

Download
memory/956-57-0x00000000753B1000-0x00000000753B3000-memory.dmp

Filesize
8KB

Download
memory/1528-81-0x0000000077700000-0x0000000077880000-memory.dmp

Filesize
1.5MB

Download
memory/2024-67-0x0000000077700000-0x0000000077880000-memory.dmp

Filesize
1.5MB

Download
memory/2024-63-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download

Analysis

Sharing