Analysis
-
max time kernel
101s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
11-08-2022 17:36
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20220721-en
General
-
Target
tmp.exe
-
Size
914KB
-
MD5
2c423d03a39192e874aab20c14d1883b
-
SHA1
023cf31791a48de9cc1ac9e2b98e47393f1d0e3b
-
SHA256
6e4597db411c7c93428ddc24f95c2d4a16c91263c12344923c04aceae016834d
-
SHA512
479d80a09d6792340f1999b51d02e59a5a578734ae6af1102dc54a0fa79040f43d6878fbd8acfd1fd57cb3751077b65c4ac1bd64a04e8f39c9dc213166cc1b5c
Malware Config
Extracted
remcos
ceo_nasco
194.5.98.28:7006
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
remcos_zxeqqeixcisywfn
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screens
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 62 IoCs
Processes:
resource yara_rule behavioral2/memory/2244-148-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-161-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-162-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-163-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-164-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-165-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-166-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-167-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-168-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-169-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-170-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-171-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-172-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-173-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-174-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-175-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-176-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-177-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-178-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-179-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-180-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-181-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-182-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-183-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-184-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-185-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-186-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-187-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-188-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-189-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-190-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-191-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-192-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-193-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-194-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-195-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-197-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-196-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-198-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-199-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-200-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-202-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-203-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-204-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-201-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-210-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-209-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-211-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-212-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-213-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-217-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-218-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-215-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-219-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-220-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-221-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-222-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-223-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-224-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-225-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-226-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 behavioral2/memory/2244-227-0x0000000004280000-0x0000000004315000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
tmp.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation tmp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
tmp.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Zhcexw = "C:\\Users\\Public\\Libraries\\wxechZ.url" tmp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2408 4956 WerFault.exe cmd.exe 3040 4956 WerFault.exe cmd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
tmp.exepid process 2244 tmp.exe 2244 tmp.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
tmp.exedescription pid process target process PID 2244 wrote to memory of 4956 2244 tmp.exe cmd.exe PID 2244 wrote to memory of 4956 2244 tmp.exe cmd.exe PID 2244 wrote to memory of 4956 2244 tmp.exe cmd.exe PID 2244 wrote to memory of 4956 2244 tmp.exe cmd.exe PID 2244 wrote to memory of 4956 2244 tmp.exe cmd.exe PID 2244 wrote to memory of 4956 2244 tmp.exe cmd.exe PID 2244 wrote to memory of 4956 2244 tmp.exe cmd.exe PID 2244 wrote to memory of 4956 2244 tmp.exe cmd.exe PID 2244 wrote to memory of 4956 2244 tmp.exe cmd.exe PID 2244 wrote to memory of 4956 2244 tmp.exe cmd.exe PID 2244 wrote to memory of 4956 2244 tmp.exe cmd.exe PID 2244 wrote to memory of 4956 2244 tmp.exe cmd.exe PID 2244 wrote to memory of 4956 2244 tmp.exe cmd.exe PID 2244 wrote to memory of 4956 2244 tmp.exe cmd.exe PID 2244 wrote to memory of 4956 2244 tmp.exe cmd.exe PID 2244 wrote to memory of 4956 2244 tmp.exe cmd.exe PID 2244 wrote to memory of 4956 2244 tmp.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 5523⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 5603⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4956 -ip 49561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4956 -ip 49561⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2244-192-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-173-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-162-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-163-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-164-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-165-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-166-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-167-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-168-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-169-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-170-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-171-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-172-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-193-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-174-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-175-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-176-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-177-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-178-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-179-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-180-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-181-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-182-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-183-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-184-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-185-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-186-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-187-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-188-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-189-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-194-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-191-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-196-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-161-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-190-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-195-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-197-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-148-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-198-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-199-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-200-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-202-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-203-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-204-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-201-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-207-0x00000000505A0000-0x00000000505C7000-memory.dmpFilesize
156KB
-
memory/2244-210-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-209-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-211-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-212-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-213-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-217-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-218-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-215-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-227-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-219-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-220-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-221-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-222-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-223-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-224-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-225-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/2244-226-0x0000000004280000-0x0000000004315000-memory.dmpFilesize
596KB
-
memory/4956-205-0x0000000000000000-mapping.dmp
-
memory/4956-214-0x00000000505A0000-0x00000000505C7000-memory.dmpFilesize
156KB
-
memory/4956-216-0x0000000001510000-0x0000000001527000-memory.dmpFilesize
92KB