Analysis
- max time kernel
148s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
10/07/2022, 22:25
General
- Target parcel.exe
- Size 747KB
- Sample220710-2bx7aafgc2
- SHA256 91dfebe2d0d1f9ac3e495529066a6cd987ad302d33be7fb7fc744f5905daf832
Malware Config
Extracted
-
remcos
-
RemoteHost
-
cobeckconstruction5430.camdvr.org:2404
-
cobeckconstruction5430317.camdvr.org:2404
-
nullhacker001.camdvr.org:2404
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-CG52CU
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
- take_screenshot_title
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- Remcos
Remcos is a closed-source remote control and surveillance software.
- ModiLoader Second Stage 39 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\parcel.exe"C:\Users\Admin\AppData\Local\Temp\parcel.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\DpiScaling.exeC:\Windows\System32\DpiScaling.exe2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2372-190-0x0000000002060000-0x00000000020DB000-memory.dmp
memory/2372-189-0x0000000002060000-0x00000000020DB000-memory.dmp
memory/2372-188-0x0000000010590000-0x000000001060E000-memory.dmp
memory/2796-162-0x00000000051F0000-0x000000000528E000-memory.dmp
memory/2796-158-0x00000000051F0000-0x000000000528E000-memory.dmp
memory/2796-146-0x00000000051F0000-0x000000000528E000-memory.dmp
memory/2796-147-0x00000000051F0000-0x000000000528E000-memory.dmp
memory/2796-148-0x00000000051F0000-0x000000000528E000-memory.dmp
memory/2796-149-0x00000000051F0000-0x000000000528E000-memory.dmp
memory/2796-150-0x00000000051F0000-0x000000000528E000-memory.dmp
memory/2796-151-0x00000000051F0000-0x000000000528E000-memory.dmp
memory/2796-153-0x00000000051F0000-0x000000000528E000-memory.dmp
memory/2796-152-0x00000000051F0000-0x000000000528E000-memory.dmp
memory/2796-154-0x00000000051F0000-0x000000000528E000-memory.dmp
memory/2796-155-0x00000000051F0000-0x000000000528E000-memory.dmp
memory/2796-156-0x00000000051F0000-0x000000000528E000-memory.dmp
memory/2796-157-0x00000000051F0000-0x000000000528E000-memory.dmp
memory/2796-163-0x00000000051F0000-0x000000000528E000-memory.dmp
memory/2796-159-0x00000000051F0000-0x000000000528E000-memory.dmp
memory/2796-160-0x00000000051F0000-0x000000000528E000-memory.dmp
memory/2796-161-0x00000000051F0000-0x000000000528E000-memory.dmp
memory/2796-144-0x00000000051F0000-0x000000000528E000-memory.dmp
memory/2796-140-0x00000000051F0000-0x000000000528E000-memory.dmp
memory/2796-169-0x00000000051F0000-0x000000000528E000-memory.dmp
memory/2796-165-0x00000000051F0000-0x000000000528E000-memory.dmp
memory/2796-145-0x00000000051F0000-0x000000000528E000-memory.dmp
memory/2796-168-0x0000000010590000-0x000000001060E000-memory.dmp
memory/2796-170-0x00000000051F0000-0x000000000528E000-memory.dmp
memory/2796-164-0x00000000051F0000-0x000000000528E000-memory.dmp
memory/2796-171-0x00000000051F0000-0x000000000528E000-memory.dmp
memory/2796-172-0x00000000051F0000-0x000000000528E000-memory.dmp
memory/2796-173-0x00000000051F0000-0x000000000528E000-memory.dmp
memory/2796-180-0x00000000051F0000-0x000000000528E000-memory.dmp
memory/2796-181-0x00000000051F0000-0x000000000528E000-memory.dmp
memory/2796-183-0x00000000051F0000-0x000000000528E000-memory.dmp
memory/2796-182-0x00000000051F0000-0x000000000528E000-memory.dmp
memory/2796-184-0x00000000051F0000-0x000000000528E000-memory.dmp
memory/2796-186-0x00000000051F0000-0x000000000528E000-memory.dmp
memory/2796-185-0x00000000051F0000-0x000000000528E000-memory.dmp
memory/2796-187-0x00000000051F0000-0x000000000528E000-memory.dmp
memory/2796-143-0x00000000051F0000-0x000000000528E000-memory.dmp
memory/2796-142-0x00000000051F0000-0x000000000528E000-memory.dmp
memory/2796-141-0x00000000051F0000-0x000000000528E000-memory.dmp