Analysis
-
max time kernel
79s -
max time network
105s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04-10-2022 12:51
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Variant.Jaik.98838.12794.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Variant.Jaik.98838.12794.exe
Resource
win10v2004-20220812-en
General
-
Target
SecuriteInfo.com.Variant.Jaik.98838.12794.exe
-
Size
754KB
-
MD5
6522609f236e7417c916912de37cc6d5
-
SHA1
96b6ae7d458d7aa64850ad1f55cf75257de99cf9
-
SHA256
80bcc0545453675c158ec5a212ffe54e9aecd9c19adb4321f2d61f736e75e495
-
SHA512
00ecc21c1bbed3eb6cb2c40b15f7a2d3729bd8fe6b1a81c00c926e59628d583e2958a2f96bde7dbf51b45d9e5394ca7c689df2123791311527ee67a3478ca560
-
SSDEEP
12288:dMtnZYA3k+tEeWqFZip4Be+GA7Pes9q1ia9r0vYe+mY6Q4eYrP:WZY5+tEeWqFZip4B57Pd9qlqC6Q
Malware Config
Extracted
remcos
DUCKDOMAIN-FILE
dapsan.duckdns.org:2404
www.dapsan.biz:2404
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
keylog_crypt
true
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-BERTBE
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 62 IoCs
Processes:
resource yara_rule behavioral1/memory/900-55-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-57-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-58-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-59-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-60-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-61-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-63-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-62-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-64-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-65-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-66-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-67-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-68-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-69-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-70-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-71-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-73-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-72-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-74-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-75-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-77-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-76-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-78-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-79-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-80-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-81-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-82-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-83-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-84-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-86-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-87-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-85-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-88-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-89-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-91-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-90-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-92-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-93-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-94-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-95-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-96-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-98-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-97-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-99-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-100-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-104-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-103-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-102-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-101-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-105-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-106-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-107-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-108-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-110-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-109-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-112-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-111-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-113-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-114-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-116-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-117-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 behavioral1/memory/900-115-0x0000000000370000-0x000000000039A000-memory.dmp modiloader_stage2 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
SecuriteInfo.com.Variant.Jaik.98838.12794.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Vfrixuuk = "C:\\Users\\Public\\Libraries\\kuuxirfV.url" SecuriteInfo.com.Variant.Jaik.98838.12794.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1712 560 WerFault.exe msiexec.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
SecuriteInfo.com.Variant.Jaik.98838.12794.exepid process 900 SecuriteInfo.com.Variant.Jaik.98838.12794.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
SecuriteInfo.com.Variant.Jaik.98838.12794.exemsiexec.exedescription pid process target process PID 900 wrote to memory of 560 900 SecuriteInfo.com.Variant.Jaik.98838.12794.exe msiexec.exe PID 900 wrote to memory of 560 900 SecuriteInfo.com.Variant.Jaik.98838.12794.exe msiexec.exe PID 900 wrote to memory of 560 900 SecuriteInfo.com.Variant.Jaik.98838.12794.exe msiexec.exe PID 900 wrote to memory of 560 900 SecuriteInfo.com.Variant.Jaik.98838.12794.exe msiexec.exe PID 900 wrote to memory of 560 900 SecuriteInfo.com.Variant.Jaik.98838.12794.exe msiexec.exe PID 900 wrote to memory of 560 900 SecuriteInfo.com.Variant.Jaik.98838.12794.exe msiexec.exe PID 900 wrote to memory of 560 900 SecuriteInfo.com.Variant.Jaik.98838.12794.exe msiexec.exe PID 900 wrote to memory of 560 900 SecuriteInfo.com.Variant.Jaik.98838.12794.exe msiexec.exe PID 900 wrote to memory of 560 900 SecuriteInfo.com.Variant.Jaik.98838.12794.exe msiexec.exe PID 900 wrote to memory of 560 900 SecuriteInfo.com.Variant.Jaik.98838.12794.exe msiexec.exe PID 900 wrote to memory of 560 900 SecuriteInfo.com.Variant.Jaik.98838.12794.exe msiexec.exe PID 900 wrote to memory of 560 900 SecuriteInfo.com.Variant.Jaik.98838.12794.exe msiexec.exe PID 900 wrote to memory of 560 900 SecuriteInfo.com.Variant.Jaik.98838.12794.exe msiexec.exe PID 900 wrote to memory of 560 900 SecuriteInfo.com.Variant.Jaik.98838.12794.exe msiexec.exe PID 900 wrote to memory of 560 900 SecuriteInfo.com.Variant.Jaik.98838.12794.exe msiexec.exe PID 900 wrote to memory of 560 900 SecuriteInfo.com.Variant.Jaik.98838.12794.exe msiexec.exe PID 900 wrote to memory of 560 900 SecuriteInfo.com.Variant.Jaik.98838.12794.exe msiexec.exe PID 900 wrote to memory of 560 900 SecuriteInfo.com.Variant.Jaik.98838.12794.exe msiexec.exe PID 900 wrote to memory of 560 900 SecuriteInfo.com.Variant.Jaik.98838.12794.exe msiexec.exe PID 900 wrote to memory of 560 900 SecuriteInfo.com.Variant.Jaik.98838.12794.exe msiexec.exe PID 900 wrote to memory of 560 900 SecuriteInfo.com.Variant.Jaik.98838.12794.exe msiexec.exe PID 560 wrote to memory of 1712 560 msiexec.exe WerFault.exe PID 560 wrote to memory of 1712 560 msiexec.exe WerFault.exe PID 560 wrote to memory of 1712 560 msiexec.exe WerFault.exe PID 560 wrote to memory of 1712 560 msiexec.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Jaik.98838.12794.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Jaik.98838.12794.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exeC:\Windows\System32\msiexec.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 560 -s 3723⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/560-120-0x0000000000000000-mapping.dmp
-
memory/560-132-0x0000000010590000-0x0000000010613000-memory.dmpFilesize
524KB
-
memory/560-134-0x0000000000B10000-0x0000000000B90000-memory.dmpFilesize
512KB
-
memory/900-54-0x0000000075571000-0x0000000075573000-memory.dmpFilesize
8KB
-
memory/900-55-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-57-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-58-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-59-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-60-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-61-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-63-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-62-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-64-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-65-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-66-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-67-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-68-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-69-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-70-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-71-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-73-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-72-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-74-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-75-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-77-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-76-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-78-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-79-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-80-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-81-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-82-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-83-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-84-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-86-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-87-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-85-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-88-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-89-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-91-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-90-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-92-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-93-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-94-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-95-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-96-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-98-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-97-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-99-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-100-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-104-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-103-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-102-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-101-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-105-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-106-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-107-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-108-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-110-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-109-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-112-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-111-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-113-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-114-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-116-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-117-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/900-115-0x0000000000370000-0x000000000039A000-memory.dmpFilesize
168KB
-
memory/1712-131-0x0000000000000000-mapping.dmp