modiloader | 43e1f1635e1cca717e2d9598e708ded20f6e9236f68ab9d3a28b83e49c71fd32

General

Target
9da633ea2a82f9c7605791cd53b370cd.exe
Size 792KB
Sample220810-ry6f3adch3
SHA256 43e1f1635e1cca717e2d9598e708ded20f6e9236f68ab9d3a28b83e49c71fd32
MD5 9da633ea2a82f9c7605791cd53b370cd
SHA1 b9a0a6d747edfb95ec93de80ef172527f61b5797
SHA512 ddbd5dfbcb7a7241fb223a8d36553c761966cbf55672a3df1eb29fa1dbb8966d82968d5059b2b7659ff20bcfbb0eb984eb62999b33f23a78e6632f1f25de394e
MD5 SHA1 SHA512

Score

10^/10

modiloader remcos onige123 collection persistence rat spyware stealer trojan

Malware Config

Extracted

Family

remcos

Botnet

onige123

C2

goodygoody.duckdns.org:1905
154.53.43.207:1905

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
gamingsofts.exe
delete_file
false
hide_file
true
hide_keylog_file
true
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
aesjes.dat
keylog_flag
false
keylog_path
%AppData%
mouse_option
false
mutex
sijresuestusawar-YZOEW4
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
gamingsoft
take_screenshot_option
false
take_screenshot_time
5

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/404-155-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/2240-154-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/2240-157-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 4 IoCs

resource	yara_rule
behavioral2/memory/1248-156-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/404-155-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft
behavioral2/memory/2240-154-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/2240-157-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	9da633ea2a82f9c7605791cd53b370cd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Avbmtavrx = "C:\\Users\\Public\\Libraries\\xrvatmbvA.url"	9da633ea2a82f9c7605791cd53b370cd.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 956 set thread context of 2240	956	9da633ea2a82f9c7605791cd53b370cd.exe	88
PID 956 set thread context of 404	956	9da633ea2a82f9c7605791cd53b370cd.exe	89
PID 956 set thread context of 1248	956	9da633ea2a82f9c7605791cd53b370cd.exe	90

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2240	9da633ea2a82f9c7605791cd53b370cd.exe
2240	9da633ea2a82f9c7605791cd53b370cd.exe
1248	9da633ea2a82f9c7605791cd53b370cd.exe
1248	9da633ea2a82f9c7605791cd53b370cd.exe
2240	9da633ea2a82f9c7605791cd53b370cd.exe
2240	9da633ea2a82f9c7605791cd53b370cd.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
956	9da633ea2a82f9c7605791cd53b370cd.exe
956	9da633ea2a82f9c7605791cd53b370cd.exe
956	9da633ea2a82f9c7605791cd53b370cd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1248	9da633ea2a82f9c7605791cd53b370cd.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 2240	956	9da633ea2a82f9c7605791cd53b370cd.exe	88
PID 956 wrote to memory of 2240	956	9da633ea2a82f9c7605791cd53b370cd.exe	88
PID 956 wrote to memory of 2240	956	9da633ea2a82f9c7605791cd53b370cd.exe	88
PID 956 wrote to memory of 404	956	9da633ea2a82f9c7605791cd53b370cd.exe	89
PID 956 wrote to memory of 404	956	9da633ea2a82f9c7605791cd53b370cd.exe	89
PID 956 wrote to memory of 404	956	9da633ea2a82f9c7605791cd53b370cd.exe	89
PID 956 wrote to memory of 1248	956	9da633ea2a82f9c7605791cd53b370cd.exe	90
PID 956 wrote to memory of 1248	956	9da633ea2a82f9c7605791cd53b370cd.exe	90
PID 956 wrote to memory of 1248	956	9da633ea2a82f9c7605791cd53b370cd.exe	90

C:\Users\Admin\AppData\Local\Temp\9da633ea2a82f9c7605791cd53b370cd.exe
"C:\Users\Admin\AppData\Local\Temp\9da633ea2a82f9c7605791cd53b370cd.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:956
- C:\Users\Admin\AppData\Local\Temp\9da633ea2a82f9c7605791cd53b370cd.exe
  C:\Users\Admin\AppData\Local\Temp\9da633ea2a82f9c7605791cd53b370cd.exe /stext "C:\Users\Admin\AppData\Local\Temp\wlmymzpkl"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2240
- C:\Users\Admin\AppData\Local\Temp\9da633ea2a82f9c7605791cd53b370cd.exe
  C:\Users\Admin\AppData\Local\Temp\9da633ea2a82f9c7605791cd53b370cd.exe /stext "C:\Users\Admin\AppData\Local\Temp\hgsjnrzlzyro"
  2⤵
  - Accesses Microsoft Outlook accounts
  PID:404
- C:\Users\Admin\AppData\Local\Temp\9da633ea2a82f9c7605791cd53b370cd.exe
  C:\Users\Admin\AppData\Local\Temp\9da633ea2a82f9c7605791cd53b370cd.exe /stext "C:\Users\Admin\AppData\Local\Temp\jifcojkfngjtfkd"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1248

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wlmymzpkl

Path C:\Users\Admin\AppData\Local\Temp\wlmymzpkl
Size 4KB
SHA256 66635dcdbf3439d7e09ac3f043c0ff6792f1ec281070fea4618d9b5fb287cb56
MD5 a64ef19cb7924d0ef7b27699e0237041
SHA1 b6392aa8451f0721fcadff793808f8630182e66e
SHA512 66f6ae0b27227cfaf57a28e8f592a899375f763d0dc1e4f0199444b52e026f04243761bb20af127a7815a5c59db3c9fe1c1ff2a3ef069b8eccff3eef68da284b
SSDEEP 48:wvvv0wQxfvvcwQxfdvv0wQxBvv0wQxakvv0wQ7:mvExvMp1vEPvEbvE7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/404-155-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/956-146-0x0000000005330000-0x00000000053B1000-memory.dmp

Download

memory/956-149-0x0000000005330000-0x00000000053B1000-memory.dmp

Download

memory/956-150-0x00000000053C0000-0x000000000543E000-memory.dmp

Download

memory/956-159-0x00000000053C0000-0x000000000543E000-memory.dmp

Download

memory/1248-156-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2240-154-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2240-157-0x0000000000400000-0x0000000000478000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads