modiloader | b5e7cea30a491e2276bbe69336aa944f953b49262ffd813347457bb57d7864fc

General

Target
SecuriteInfo.com.W32.AIDetect.malware2.30734.exe
Size 615KB
Sample220821-e38e1achbr
SHA256 b5e7cea30a491e2276bbe69336aa944f953b49262ffd813347457bb57d7864fc
MD5 fbe60952002b6fff30d3e6d3d731ef45
SHA1 7ce9a0cf7cabbcde794ffbef98784af425a87ff8
SHA512 7d4eb283f3655ffde30d2235c15402756398fda4d7bf300187e147eb6363df86720c5712a5f26692182d3492ced56d8eb286a98b0a84ed29ad7a76baad42f6b1
MD5 SHA1 SHA512

Score

10^/10

modiloader remcos gifted persistence rat trojan

Malware Config

Extracted

Family

remcos

Version

2.7.1 Pro

Botnet

GIFTED

C2

thankgod1.ddns.net:4770

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-XCILNF
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Control Panel\International\Geo\Nation	SecuriteInfo.com.W32.AIDetect.malware2.30734.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Aofnpwsju = "C:\\Users\\Public\\Libraries\\ujswpnfoA.url"	SecuriteInfo.com.W32.AIDetect.malware2.30734.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	cleanmgr.exe
File opened (read-only)	\??\E:	cleanmgr.exe
File opened (read-only)	\??\K:	cleanmgr.exe
File opened (read-only)	\??\P:	cleanmgr.exe
File opened (read-only)	\??\T:	cleanmgr.exe
File opened (read-only)	\??\B:	cleanmgr.exe
File opened (read-only)	\??\G:	cleanmgr.exe
File opened (read-only)	\??\H:	cleanmgr.exe
File opened (read-only)	\??\I:	cleanmgr.exe
File opened (read-only)	\??\L:	cleanmgr.exe
File opened (read-only)	\??\N:	cleanmgr.exe
File opened (read-only)	\??\R:	cleanmgr.exe
File opened (read-only)	\??\X:	cleanmgr.exe
File opened (read-only)	\??\Z:	cleanmgr.exe
File opened (read-only)	\??\F:	cleanmgr.exe
File opened (read-only)	\??\J:	cleanmgr.exe
File opened (read-only)	\??\M:	cleanmgr.exe
File opened (read-only)	\??\Q:	cleanmgr.exe
File opened (read-only)	\??\S:	cleanmgr.exe
File opened (read-only)	\??\U:	cleanmgr.exe
File opened (read-only)	\??\V:	cleanmgr.exe
File opened (read-only)	\??\W:	cleanmgr.exe
File opened (read-only)	\??\Y:	cleanmgr.exe
File opened (read-only)	\??\O:	cleanmgr.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\LogFiles\setupcln\setuperr.log	cleanmgr.exe
File opened for modification	C:\Windows\system32\LogFiles\setupcln\diagerr.xml	cleanmgr.exe
File opened for modification	C:\Windows\system32\LogFiles\setupcln\diagwrn.xml	cleanmgr.exe
File opened for modification	C:\Windows\system32\LogFiles\setupcln\setupact.log	cleanmgr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2060	SecuriteInfo.com.W32.AIDetect.malware2.30734.exe
2060	SecuriteInfo.com.W32.AIDetect.malware2.30734.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 3616	2060	SecuriteInfo.com.W32.AIDetect.malware2.30734.exe	89
PID 2060 wrote to memory of 3616	2060	SecuriteInfo.com.W32.AIDetect.malware2.30734.exe	89
PID 2060 wrote to memory of 3616	2060	SecuriteInfo.com.W32.AIDetect.malware2.30734.exe	89
PID 2060 wrote to memory of 3616	2060	SecuriteInfo.com.W32.AIDetect.malware2.30734.exe	89
PID 2060 wrote to memory of 3616	2060	SecuriteInfo.com.W32.AIDetect.malware2.30734.exe	89
PID 2060 wrote to memory of 3616	2060	SecuriteInfo.com.W32.AIDetect.malware2.30734.exe	89
PID 2060 wrote to memory of 3616	2060	SecuriteInfo.com.W32.AIDetect.malware2.30734.exe	89
PID 2060 wrote to memory of 3616	2060	SecuriteInfo.com.W32.AIDetect.malware2.30734.exe	89
PID 2060 wrote to memory of 3616	2060	SecuriteInfo.com.W32.AIDetect.malware2.30734.exe	89
PID 2060 wrote to memory of 3616	2060	SecuriteInfo.com.W32.AIDetect.malware2.30734.exe	89
PID 2060 wrote to memory of 3616	2060	SecuriteInfo.com.W32.AIDetect.malware2.30734.exe	89
PID 2060 wrote to memory of 3616	2060	SecuriteInfo.com.W32.AIDetect.malware2.30734.exe	89
PID 2060 wrote to memory of 3616	2060	SecuriteInfo.com.W32.AIDetect.malware2.30734.exe	89
PID 2060 wrote to memory of 3616	2060	SecuriteInfo.com.W32.AIDetect.malware2.30734.exe	89
PID 2060 wrote to memory of 3616	2060	SecuriteInfo.com.W32.AIDetect.malware2.30734.exe	89

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware2.30734.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware2.30734.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\cleanmgr.exe
  "C:\Windows\System32\cleanmgr.exe"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  PID:3616

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2060-164-0x0000000050540000-0x0000000050564000-memory.dmp

Download

memory/3616-165-0x0000000050540000-0x0000000050564000-memory.dmp

Download

memory/3616-223-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3616-224-0x0000000000400000-0x0000000000421000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads