modiloader | 80bcc0545453675c158ec5a212ffe54e9aecd9c19adb4321f2d61f736e75e495

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2022 12:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe
Size

754KB
MD5

6522609f236e7417c916912de37cc6d5
SHA1

96b6ae7d458d7aa64850ad1f55cf75257de99cf9
SHA256

80bcc0545453675c158ec5a212ffe54e9aecd9c19adb4321f2d61f736e75e495
SHA512

00ecc21c1bbed3eb6cb2c40b15f7a2d3729bd8fe6b1a81c00c926e59628d583e2958a2f96bde7dbf51b45d9e5394ca7c689df2123791311527ee67a3478ca560
SSDEEP

12288:dMtnZYA3k+tEeWqFZip4Be+GA7Pes9q1ia9r0vYe+mY6Q4eYrP:WZY5+tEeWqFZip4B57Pd9qlqC6Q

Score

10^/10

modiloader remcos duckdomain-file persistence rat trojan

Malware Config

Extracted

Family

remcos

Botnet

DUCKDOMAIN-FILE

dapsan.duckdns.org:2404

www.dapsan.biz:2404

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-BERTBE
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

ModiLoader Second Stage 63 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4616-132-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-137-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-136-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-135-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-134-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-138-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-139-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-140-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-141-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-142-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-143-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-144-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-145-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-147-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-148-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-152-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-149-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-151-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-150-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-146-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-153-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-154-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-155-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-156-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-157-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-159-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-160-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-161-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-158-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-163-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-164-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-165-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-162-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-166-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-167-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-168-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-169-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-171-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-172-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-170-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-173-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-174-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-175-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-176-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-177-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-178-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-179-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-180-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-181-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-182-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-183-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-184-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-185-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-186-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-187-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-189-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-188-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-190-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-191-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-192-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-193-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-195-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2
behavioral2/memory/4616-194-0x0000000002850000-0x000000000287A000-memory.dmp	modiloader_stage2

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Vfrixuuk = "C:\\Users\\Public\\Libraries\\kuuxirfV.url"	SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3824 1136 WerFault.exe msiexec.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe

pid process

4616 SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe
4616 SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe

pid	pid_target	process	target process
3824	1136	WerFault.exe	msiexec.exe

pid	process
4616	SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe
4616	SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe

description	pid	process	target process
PID 4616 wrote to memory of 1136	4616	SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe	msiexec.exe
PID 4616 wrote to memory of 1136	4616	SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe	msiexec.exe
PID 4616 wrote to memory of 1136	4616	SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe	msiexec.exe
PID 4616 wrote to memory of 1136	4616	SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe	msiexec.exe
PID 4616 wrote to memory of 1136	4616	SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe	msiexec.exe
PID 4616 wrote to memory of 1136	4616	SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe	msiexec.exe
PID 4616 wrote to memory of 1136	4616	SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe	msiexec.exe
PID 4616 wrote to memory of 1136	4616	SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe	msiexec.exe
PID 4616 wrote to memory of 1136	4616	SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe	msiexec.exe
PID 4616 wrote to memory of 1136	4616	SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe	msiexec.exe
PID 4616 wrote to memory of 1136	4616	SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe	msiexec.exe
PID 4616 wrote to memory of 1136	4616	SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe	msiexec.exe
PID 4616 wrote to memory of 1136	4616	SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe	msiexec.exe
PID 4616 wrote to memory of 1136	4616	SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe	msiexec.exe
PID 4616 wrote to memory of 1136	4616	SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe	msiexec.exe
PID 4616 wrote to memory of 1136	4616	SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe	msiexec.exe
PID 4616 wrote to memory of 1136	4616	SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe	msiexec.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Jaik.98838.12794.21309.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4616

C:\Windows\SysWOW64\msiexec.exe
C:\Windows\System32\msiexec.exe
2⤵
PID:1136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1136 -s 892
3⤵
- Program crash
PID:3824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1136 -ip 1136
1⤵
PID:1884

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1136-251-0x0000000000000000-mapping.dmp

Download
memory/1136-332-0x0000000010590000-0x0000000010613000-memory.dmp

Filesize
524KB

Download
memory/1136-333-0x0000000003E00000-0x0000000003E80000-memory.dmp

Filesize
512KB

Download
memory/4616-132-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-137-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-136-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-135-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-134-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-138-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-139-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-140-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-141-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-142-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-143-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-144-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-145-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-147-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-148-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-152-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-149-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-151-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-150-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-146-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-153-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-154-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-155-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-156-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-157-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-159-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-160-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-161-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-158-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-163-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-164-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-165-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-162-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-166-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-167-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-168-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-169-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-171-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-172-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-170-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-173-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-174-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-175-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-176-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-177-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-178-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-179-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-180-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-181-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-182-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-183-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-184-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-185-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-186-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-187-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-189-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-188-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-190-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-191-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-192-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-193-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-195-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/4616-194-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download