Analysis
-
max time kernel
49s -
max time network
56s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04-10-2022 12:50
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe
Resource
win10v2004-20220901-en
General
-
Target
SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe
-
Size
754KB
-
MD5
6522609f236e7417c916912de37cc6d5
-
SHA1
96b6ae7d458d7aa64850ad1f55cf75257de99cf9
-
SHA256
80bcc0545453675c158ec5a212ffe54e9aecd9c19adb4321f2d61f736e75e495
-
SHA512
00ecc21c1bbed3eb6cb2c40b15f7a2d3729bd8fe6b1a81c00c926e59628d583e2958a2f96bde7dbf51b45d9e5394ca7c689df2123791311527ee67a3478ca560
-
SSDEEP
12288:dMtnZYA3k+tEeWqFZip4Be+GA7Pes9q1ia9r0vYe+mY6Q4eYrP:WZY5+tEeWqFZip4B57Pd9qlqC6Q
Malware Config
Extracted
remcos
DUCKDOMAIN-FILE
dapsan.duckdns.org:2404
www.dapsan.biz:2404
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
keylog_crypt
true
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-BERTBE
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 62 IoCs
Processes:
resource yara_rule behavioral1/memory/284-55-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-57-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-58-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-59-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-60-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-61-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-63-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-65-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-64-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-62-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-66-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-68-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-67-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-69-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-71-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-72-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-70-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-74-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-73-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-75-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-76-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-78-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-77-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-80-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-81-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-82-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-79-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-84-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-85-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-87-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-88-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-90-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-89-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-86-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-83-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-91-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-93-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-92-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-95-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-94-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-99-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-98-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-97-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-96-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-103-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-102-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-101-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-100-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-104-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-105-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-106-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-107-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-108-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-109-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-111-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-113-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-112-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-110-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-114-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-117-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-116-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 behavioral1/memory/284-115-0x00000000002A0000-0x00000000002CA000-memory.dmp modiloader_stage2 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Vfrixuuk = "C:\\Users\\Public\\Libraries\\kuuxirfV.url" SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 572 1836 WerFault.exe msiexec.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exepid process 284 SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exemsiexec.exedescription pid process target process PID 284 wrote to memory of 1836 284 SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe msiexec.exe PID 284 wrote to memory of 1836 284 SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe msiexec.exe PID 284 wrote to memory of 1836 284 SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe msiexec.exe PID 284 wrote to memory of 1836 284 SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe msiexec.exe PID 284 wrote to memory of 1836 284 SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe msiexec.exe PID 284 wrote to memory of 1836 284 SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe msiexec.exe PID 284 wrote to memory of 1836 284 SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe msiexec.exe PID 284 wrote to memory of 1836 284 SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe msiexec.exe PID 284 wrote to memory of 1836 284 SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe msiexec.exe PID 284 wrote to memory of 1836 284 SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe msiexec.exe PID 284 wrote to memory of 1836 284 SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe msiexec.exe PID 284 wrote to memory of 1836 284 SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe msiexec.exe PID 284 wrote to memory of 1836 284 SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe msiexec.exe PID 284 wrote to memory of 1836 284 SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe msiexec.exe PID 284 wrote to memory of 1836 284 SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe msiexec.exe PID 284 wrote to memory of 1836 284 SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe msiexec.exe PID 284 wrote to memory of 1836 284 SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe msiexec.exe PID 284 wrote to memory of 1836 284 SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe msiexec.exe PID 284 wrote to memory of 1836 284 SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe msiexec.exe PID 284 wrote to memory of 1836 284 SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe msiexec.exe PID 284 wrote to memory of 1836 284 SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe msiexec.exe PID 1836 wrote to memory of 572 1836 msiexec.exe WerFault.exe PID 1836 wrote to memory of 572 1836 msiexec.exe WerFault.exe PID 1836 wrote to memory of 572 1836 msiexec.exe WerFault.exe PID 1836 wrote to memory of 572 1836 msiexec.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exeC:\Windows\System32\msiexec.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 3723⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/284-54-0x0000000076201000-0x0000000076203000-memory.dmpFilesize
8KB
-
memory/284-55-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-57-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-58-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-59-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-60-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-61-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-63-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-65-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-64-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-62-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-66-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-68-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-67-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-69-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-71-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-72-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-70-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-74-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-73-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-75-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-76-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-78-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-77-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-80-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-81-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-82-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-79-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-84-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-85-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-87-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-88-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-90-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-89-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-86-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-83-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-91-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-93-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-92-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-95-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-94-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-99-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-98-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-97-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-96-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-103-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-102-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-101-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-100-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-104-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-105-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-106-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-107-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-108-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-109-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-111-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-113-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-112-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-110-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-114-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-117-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-116-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/284-115-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/572-129-0x0000000000000000-mapping.dmp
-
memory/1836-120-0x0000000000000000-mapping.dmp
-
memory/1836-132-0x0000000001F60000-0x0000000001FE0000-memory.dmpFilesize
512KB
-
memory/1836-130-0x0000000010590000-0x0000000010613000-memory.dmpFilesize
524KB