Analysis
-
max time kernel
162s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04-10-2022 12:51
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Variant.Jaik.98838.12794.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Variant.Jaik.98838.12794.exe
Resource
win10v2004-20220812-en
General
-
Target
SecuriteInfo.com.Variant.Jaik.98838.12794.exe
-
Size
754KB
-
MD5
6522609f236e7417c916912de37cc6d5
-
SHA1
96b6ae7d458d7aa64850ad1f55cf75257de99cf9
-
SHA256
80bcc0545453675c158ec5a212ffe54e9aecd9c19adb4321f2d61f736e75e495
-
SHA512
00ecc21c1bbed3eb6cb2c40b15f7a2d3729bd8fe6b1a81c00c926e59628d583e2958a2f96bde7dbf51b45d9e5394ca7c689df2123791311527ee67a3478ca560
-
SSDEEP
12288:dMtnZYA3k+tEeWqFZip4Be+GA7Pes9q1ia9r0vYe+mY6Q4eYrP:WZY5+tEeWqFZip4B57Pd9qlqC6Q
Malware Config
Extracted
remcos
DUCKDOMAIN-FILE
dapsan.duckdns.org:2404
www.dapsan.biz:2404
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
keylog_crypt
true
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-BERTBE
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 63 IoCs
Processes:
resource yara_rule behavioral2/memory/1456-132-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-135-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-136-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-137-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-134-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-138-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-139-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-140-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-141-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-143-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-144-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-145-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-142-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-146-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-148-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-147-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-149-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-150-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-151-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-153-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-152-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-155-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-154-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-156-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-158-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-161-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-160-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-159-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-157-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-162-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-163-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-164-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-166-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-165-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-167-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-168-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-169-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-170-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-171-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-172-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-173-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-174-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-175-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-176-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-177-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-178-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-179-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-180-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-181-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-182-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-183-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-184-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-185-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-186-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-187-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-188-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-189-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-190-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-191-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-192-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-193-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-195-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 behavioral2/memory/1456-194-0x0000000002750000-0x000000000277A000-memory.dmp modiloader_stage2 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
SecuriteInfo.com.Variant.Jaik.98838.12794.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Vfrixuuk = "C:\\Users\\Public\\Libraries\\kuuxirfV.url" SecuriteInfo.com.Variant.Jaik.98838.12794.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
SecuriteInfo.com.Variant.Jaik.98838.12794.exepid process 1456 SecuriteInfo.com.Variant.Jaik.98838.12794.exe 1456 SecuriteInfo.com.Variant.Jaik.98838.12794.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
SecuriteInfo.com.Variant.Jaik.98838.12794.exedescription pid process target process PID 1456 wrote to memory of 5044 1456 SecuriteInfo.com.Variant.Jaik.98838.12794.exe colorcpl.exe PID 1456 wrote to memory of 5044 1456 SecuriteInfo.com.Variant.Jaik.98838.12794.exe colorcpl.exe PID 1456 wrote to memory of 5044 1456 SecuriteInfo.com.Variant.Jaik.98838.12794.exe colorcpl.exe PID 1456 wrote to memory of 5044 1456 SecuriteInfo.com.Variant.Jaik.98838.12794.exe colorcpl.exe PID 1456 wrote to memory of 5044 1456 SecuriteInfo.com.Variant.Jaik.98838.12794.exe colorcpl.exe PID 1456 wrote to memory of 5044 1456 SecuriteInfo.com.Variant.Jaik.98838.12794.exe colorcpl.exe PID 1456 wrote to memory of 5044 1456 SecuriteInfo.com.Variant.Jaik.98838.12794.exe colorcpl.exe PID 1456 wrote to memory of 5044 1456 SecuriteInfo.com.Variant.Jaik.98838.12794.exe colorcpl.exe PID 1456 wrote to memory of 5044 1456 SecuriteInfo.com.Variant.Jaik.98838.12794.exe colorcpl.exe PID 1456 wrote to memory of 5044 1456 SecuriteInfo.com.Variant.Jaik.98838.12794.exe colorcpl.exe PID 1456 wrote to memory of 5044 1456 SecuriteInfo.com.Variant.Jaik.98838.12794.exe colorcpl.exe PID 1456 wrote to memory of 5044 1456 SecuriteInfo.com.Variant.Jaik.98838.12794.exe colorcpl.exe PID 1456 wrote to memory of 5044 1456 SecuriteInfo.com.Variant.Jaik.98838.12794.exe colorcpl.exe PID 1456 wrote to memory of 5044 1456 SecuriteInfo.com.Variant.Jaik.98838.12794.exe colorcpl.exe PID 1456 wrote to memory of 5044 1456 SecuriteInfo.com.Variant.Jaik.98838.12794.exe colorcpl.exe PID 1456 wrote to memory of 5044 1456 SecuriteInfo.com.Variant.Jaik.98838.12794.exe colorcpl.exe PID 1456 wrote to memory of 5044 1456 SecuriteInfo.com.Variant.Jaik.98838.12794.exe colorcpl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Jaik.98838.12794.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Jaik.98838.12794.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\colorcpl.exeC:\Windows\System32\colorcpl.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1456-132-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-135-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-136-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-137-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-134-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-138-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-139-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-140-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-141-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-143-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-144-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-145-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-142-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-146-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-148-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-147-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-149-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-150-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-151-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-153-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-152-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-155-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-154-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-156-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-158-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-161-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-160-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-159-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-157-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-162-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-163-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-164-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-166-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-165-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-167-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-168-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-169-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-170-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-171-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-172-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-173-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-174-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-175-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-176-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-177-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-178-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-179-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-180-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-181-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-182-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-183-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-184-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-185-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-186-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-187-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-188-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-189-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-190-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-191-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-192-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-193-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-195-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/1456-194-0x0000000002750000-0x000000000277A000-memory.dmpFilesize
168KB
-
memory/5044-251-0x0000000000000000-mapping.dmp
-
memory/5044-332-0x0000000010590000-0x0000000010613000-memory.dmpFilesize
524KB
-
memory/5044-333-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/5044-334-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB