remcos | 162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6

General

Target

162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6.exe
Size

597KB
MD5

419bf8b9f950bbf4e89cdde4de7601b9
SHA1

a2e7419f565599a74b41e041175ce240677581a4
SHA256

162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6
SHA512

bea432937e909a1aa57ee1ce1194b98bc3ac0d16c5ff76cbc783c363af4cf0a9b1e848fa6e7307725818a47a5f2686b152507519b636c4514ea2ed7c7602dc9f

Score

10^/10

remcos modzillaload persistence rat

Malware Config

Extracted

Family

remcos

Version

2.0.3 Pro

Botnet

modzillaload

C2

hhlari.ddns.net:5001

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
modzillaload.exe
copy_folder
modzillaload
delete_file
true
hide_file
true
hide_keylog_file
true
install_flag
true
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
workload
keylog_path
%AppData%
mouse_option
false
mutex
workload-FM1X2V
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
modzillaload
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 2 IoCs

pid	Process
3088	modzillaload.exe
4196	modzillaload.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\modzillaload = "\"C:\\Users\\Admin\\AppData\\Roaming\\modzillaload\\modzillaload.exe\""	modzillaload.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows\CurrentVersion\Run\	162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\modzillaload = "\"C:\\Users\\Admin\\AppData\\Roaming\\modzillaload\\modzillaload.exe\""	162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows\CurrentVersion\Run\	modzillaload.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4860 set thread context of 4592	4860	162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6.exe	82
PID 3088 set thread context of 4196	3088	modzillaload.exe	91

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings	162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4860	162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6.exe
3088	modzillaload.exe
4196	modzillaload.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 4592	4860	162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6.exe	82
PID 4860 wrote to memory of 4592	4860	162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6.exe	82
PID 4860 wrote to memory of 4592	4860	162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6.exe	82
PID 4592 wrote to memory of 1764	4592	162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6.exe	87
PID 4592 wrote to memory of 1764	4592	162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6.exe	87
PID 4592 wrote to memory of 1764	4592	162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6.exe	87
PID 1764 wrote to memory of 1812	1764	WScript.exe	88
PID 1764 wrote to memory of 1812	1764	WScript.exe	88
PID 1764 wrote to memory of 1812	1764	WScript.exe	88
PID 1812 wrote to memory of 3088	1812	cmd.exe	90
PID 1812 wrote to memory of 3088	1812	cmd.exe	90
PID 1812 wrote to memory of 3088	1812	cmd.exe	90
PID 3088 wrote to memory of 4196	3088	modzillaload.exe	91
PID 3088 wrote to memory of 4196	3088	modzillaload.exe	91
PID 3088 wrote to memory of 4196	3088	modzillaload.exe	91

C:\Users\Admin\AppData\Local\Temp\162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6.exe
"C:\Users\Admin\AppData\Local\Temp\162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Users\Admin\AppData\Local\Temp\162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6.exe
  C:\Users\Admin\AppData\Local\Temp\162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:1764
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\modzillaload\modzillaload.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1812
    - - C:\Users\Admin\AppData\Roaming\modzillaload\modzillaload.exe
        
        C:\Users\Admin\AppData\Roaming\modzillaload\modzillaload.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3088
      - C:\Users\Admin\AppData\Roaming\modzillaload\modzillaload.exe
        
        :\Users\Admin\AppData\Roaming\modzillaload\modzillaload.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetWindowsHookEx
        
        PID:4196

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.vbs

Filesize
682B

MD5
951370e137d06f35bba436d4d4537edd

SHA1
987c3f0d4efdfeaec51da2e298318bdc58b70a6e

SHA256
5d9071194fa2ff798e678184b8cee4ef17adeb49dfcdc77a7c46ebea3c0510a7

SHA512
075f23f01c624a96490585c8e6bd9aaeb69d3d777710d580050679292271b3590f4164926188990bd7f3cca5ea0b995d2eef3bfacb9d460500a652105e5eeba0

Download Submit
C:\Users\Admin\AppData\Roaming\modzillaload\modzillaload.exe

Filesize
597KB

MD5
419bf8b9f950bbf4e89cdde4de7601b9

SHA1
a2e7419f565599a74b41e041175ce240677581a4

SHA256
162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6

SHA512
bea432937e909a1aa57ee1ce1194b98bc3ac0d16c5ff76cbc783c363af4cf0a9b1e848fa6e7307725818a47a5f2686b152507519b636c4514ea2ed7c7602dc9f

Download Submit
C:\Users\Admin\AppData\Roaming\modzillaload\modzillaload.exe

Filesize
597KB

MD5
419bf8b9f950bbf4e89cdde4de7601b9

SHA1
a2e7419f565599a74b41e041175ce240677581a4

SHA256
162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6

SHA512
bea432937e909a1aa57ee1ce1194b98bc3ac0d16c5ff76cbc783c363af4cf0a9b1e848fa6e7307725818a47a5f2686b152507519b636c4514ea2ed7c7602dc9f

Download Submit
C:\Users\Admin\AppData\Roaming\modzillaload\modzillaload.exe

Filesize
597KB

MD5
419bf8b9f950bbf4e89cdde4de7601b9

SHA1
a2e7419f565599a74b41e041175ce240677581a4

SHA256
162369ef2e44d2e07f6fc17d044e69978831e61325e3dd460a3d0d2670a809f6

SHA512
bea432937e909a1aa57ee1ce1194b98bc3ac0d16c5ff76cbc783c363af4cf0a9b1e848fa6e7307725818a47a5f2686b152507519b636c4514ea2ed7c7602dc9f

Download Submit
memory/3088-153-0x00000000778A0000-0x0000000077A43000-memory.dmp

Filesize
1.6MB

Download
memory/4196-160-0x00000000778A0000-0x0000000077A43000-memory.dmp

Filesize
1.6MB

Download
memory/4196-159-0x00000000778A0000-0x0000000077A43000-memory.dmp

Filesize
1.6MB

Download
memory/4592-138-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4592-144-0x00000000778A0000-0x0000000077A43000-memory.dmp

Filesize
1.6MB

Download
memory/4592-141-0x00000000778A0000-0x0000000077A43000-memory.dmp

Filesize
1.6MB

Download
memory/4592-135-0x00000000778A0000-0x0000000077A43000-memory.dmp

Filesize
1.6MB

Download
memory/4860-132-0x00000000022F0000-0x00000000022F7000-memory.dmp

Filesize
28KB

Download
memory/4860-134-0x00000000778A0000-0x0000000077A43000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing