Overview

overview

10

Static

static

Edited Rem...59.exe

windows7-x64

10

Edited Rem...59.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Edited Remittance Form976567874356789097876659.exe

  • Size

    909KB

  • Sample

    220915-qkmw5aghen

  • MD5

    aa3d264186ff7de4d187897b604fce83

  • SHA1

    6e46c8ea3e9757c58a0ed9fe23d09ca571a5c48e

  • SHA256

    7b1b267f85263154d6876486dea1d8c5f493f1fdd233cc885e64710cbf22c194

  • SHA512

    35069ed2045ca0440f85302ef964c124bd5a9e43bfe2db490862c17bf578011432989abf79e32add14eec328a8e17f57815b4fa3b451faf70a63901b337329ae

  • SSDEEP

    12288:1Z3m2ifTnKeXXOeh0jbXGrapowu0ZDNDoCHjsG83q/rhf7fvQB:P9irKeXXOehw2rapowuCFoT3q/lvk

Score
10/10
modiloaderremcosduckdomain-filepersistencerattrojan

Malware Config

Extracted

Family

remcos

Botnet

DUCKDOMAIN-FILE

C2

dapsan.duckdns.org:2404

www.dapsan.biz:2404
Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    true

  • install_flag

    false

  • keylog_crypt

    true

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-BERTBE

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      Edited Remittance Form976567874356789097876659.exe

    • Size

      909KB

    • MD5

      aa3d264186ff7de4d187897b604fce83

    • SHA1

      6e46c8ea3e9757c58a0ed9fe23d09ca571a5c48e

    • SHA256

      7b1b267f85263154d6876486dea1d8c5f493f1fdd233cc885e64710cbf22c194

    • SHA512

      35069ed2045ca0440f85302ef964c124bd5a9e43bfe2db490862c17bf578011432989abf79e32add14eec328a8e17f57815b4fa3b451faf70a63901b337329ae

    • SSDEEP

      12288:1Z3m2ifTnKeXXOeh0jbXGrapowu0ZDNDoCHjsG83q/rhf7fvQB:P9irKeXXOehw2rapowuCFoT3q/lvk

    Score
    10/10
    modiloadertrojanremcosduckdomain-filepersistencerat

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks