Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
-
submitted
06-08-2022 07:33
General
-
Target
2c423d03a39192e874aab20c14d1883b.exe
-
Size
914KB
-
MD5
2c423d03a39192e874aab20c14d1883b
-
SHA1
023cf31791a48de9cc1ac9e2b98e47393f1d0e3b
-
SHA256
6e4597db411c7c93428ddc24f95c2d4a16c91263c12344923c04aceae016834d
-
SHA512
479d80a09d6792340f1999b51d02e59a5a578734ae6af1102dc54a0fa79040f43d6878fbd8acfd1fd57cb3751077b65c4ac1bd64a04e8f39c9dc213166cc1b5c
Malware Config
Extracted
remcos
1.7 Pro
ceo_nasco
194.5.98.28:7006
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
remcos_zxeqqeixcisywfn
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screens
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
ModiLoader Second Stage 61 IoCs
-
Blocklisted process makes network request 16 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c423d03a39192e874aab20c14d1883b.exe"C:\Users\Admin\AppData\Local\Temp\2c423d03a39192e874aab20c14d1883b.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
-
Filesize
156KB
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
156KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB