Analysis
- max time kernel
148s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
02/07/2022, 16:48
General
- Target SecuriteInfo.com.Variant.Zusy.428082.19221.exe
- Size 1.1MB
- Sample220702-va3xtagcgp
- SHA256 a070d4d4afe48b83d5f7902c72ea7fd808525d9cd5e716d5ac9b4723ccdc3269
Malware Config
Extracted
-
remcos
-
XYZ-REMCOS
-
www.wetransfers-online.xyz:3012
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
notepad
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
notepad-IKBL7D
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
- take_screenshot_title
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- Remcos
Remcos is a closed-source remote control and surveillance software.
- ModiLoader Second Stage 39 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Zusy.428082.19221.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Zusy.428082.19221.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3196-188-0x0000000000400000-0x000000000047B000-memory.dmp
memory/3196-187-0x0000000000400000-0x000000000047B000-memory.dmp
memory/3196-186-0x0000000010590000-0x000000001060E000-memory.dmp
memory/3416-160-0x00000000052C0000-0x000000000535D000-memory.dmp
memory/3416-140-0x00000000052C0000-0x000000000535D000-memory.dmp
memory/3416-146-0x00000000052C0000-0x000000000535D000-memory.dmp
memory/3416-147-0x00000000052C0000-0x000000000535D000-memory.dmp
memory/3416-148-0x00000000052C0000-0x000000000535D000-memory.dmp
memory/3416-149-0x00000000052C0000-0x000000000535D000-memory.dmp
memory/3416-150-0x00000000052C0000-0x000000000535D000-memory.dmp
memory/3416-151-0x00000000052C0000-0x000000000535D000-memory.dmp
memory/3416-152-0x00000000052C0000-0x000000000535D000-memory.dmp
memory/3416-153-0x00000000052C0000-0x000000000535D000-memory.dmp
memory/3416-154-0x00000000052C0000-0x000000000535D000-memory.dmp
memory/3416-155-0x00000000052C0000-0x000000000535D000-memory.dmp
memory/3416-156-0x00000000052C0000-0x000000000535D000-memory.dmp
memory/3416-157-0x00000000052C0000-0x000000000535D000-memory.dmp
memory/3416-158-0x00000000052C0000-0x000000000535D000-memory.dmp
memory/3416-159-0x00000000052C0000-0x000000000535D000-memory.dmp
memory/3416-163-0x00000000052C0000-0x000000000535D000-memory.dmp
memory/3416-161-0x00000000052C0000-0x000000000535D000-memory.dmp
memory/3416-145-0x00000000052C0000-0x000000000535D000-memory.dmp
memory/3416-162-0x00000000052C0000-0x000000000535D000-memory.dmp
memory/3416-168-0x00000000052C0000-0x000000000535D000-memory.dmp
memory/3416-165-0x00000000052C0000-0x000000000535D000-memory.dmp
memory/3416-144-0x00000000052C0000-0x000000000535D000-memory.dmp
memory/3416-164-0x00000000052C0000-0x000000000535D000-memory.dmp
memory/3416-167-0x00000000052C0000-0x000000000535D000-memory.dmp
memory/3416-169-0x00000000052C0000-0x000000000535D000-memory.dmp
memory/3416-171-0x00000000052C0000-0x000000000535D000-memory.dmp
memory/3416-170-0x00000000052C0000-0x000000000535D000-memory.dmp
memory/3416-178-0x00000000052C0000-0x000000000535D000-memory.dmp
memory/3416-180-0x00000000052C0000-0x000000000535D000-memory.dmp
memory/3416-179-0x00000000052C0000-0x000000000535D000-memory.dmp
memory/3416-182-0x00000000052C0000-0x000000000535D000-memory.dmp
memory/3416-181-0x00000000052C0000-0x000000000535D000-memory.dmp
memory/3416-183-0x00000000052C0000-0x000000000535D000-memory.dmp
memory/3416-185-0x00000000052C0000-0x000000000535D000-memory.dmp
memory/3416-184-0x00000000052C0000-0x000000000535D000-memory.dmp
memory/3416-143-0x00000000052C0000-0x000000000535D000-memory.dmp
memory/3416-142-0x00000000052C0000-0x000000000535D000-memory.dmp
memory/3416-141-0x00000000052C0000-0x000000000535D000-memory.dmp