Analysis
-
max time kernel
67s -
max time network
75s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07-10-2022 17:28
Static task
static1
Behavioral task
behavioral1
Sample
Payment_Advice.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Payment_Advice.exe
Resource
win10v2004-20220812-en
General
-
Target
Payment_Advice.exe
-
Size
1013KB
-
MD5
74bfd09b9a0b0836314357a380e89af4
-
SHA1
b81ea9184aa40311e0bb3c2aeeb9f29a14e0ce42
-
SHA256
28710a59e4df3f979ce3d1cdfad0bfa9271f14f1265240b2b9273fb29d703883
-
SHA512
ed2ad0128da53a99138a6cec725a3797722061d77679fa4958d1d22b04bd2b5f1f174c7ab980589aa916d426ed3919bc332fb6614bddd829bc40aefd1038b4c1
-
SSDEEP
12288:qkQHUxA6s8jEg3sQHniC4uSJdWoQE4/2EK73WLr9RZCqsP031kX3r5wuvYe+msnX:PjO8jEg3DHnyuSjxU3XjZpwzGzj
Malware Config
Extracted
remcos
amara
betterdaysahead.duckdns.org:20987
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
rcm
-
mouse_option
false
-
mutex
Rmc-FYWA5U
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 62 IoCs
Processes:
resource yara_rule behavioral1/memory/1208-55-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-57-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-58-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-59-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-60-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-61-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-63-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-62-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-64-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-65-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-68-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-72-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-71-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-70-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-69-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-73-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-74-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-79-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-78-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-77-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-76-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-75-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-67-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-66-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-80-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-83-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-85-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-84-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-82-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-81-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-86-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-87-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-88-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-89-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-90-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-91-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-92-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-94-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-93-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-95-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-96-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-99-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-98-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-97-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-100-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-103-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-104-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-102-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-101-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-106-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-105-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-108-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-107-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-109-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-110-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-111-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-113-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-112-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-114-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-116-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-115-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 behavioral1/memory/1208-117-0x0000000000300000-0x000000000032A000-memory.dmp modiloader_stage2 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Payment_Advice.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Kwyggprh = "C:\\Users\\Public\\Libraries\\hrpggywK.url" Payment_Advice.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1948 1908 WerFault.exe iexpress.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Payment_Advice.exepid process 1208 Payment_Advice.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
Payment_Advice.exeiexpress.exedescription pid process target process PID 1208 wrote to memory of 1908 1208 Payment_Advice.exe iexpress.exe PID 1208 wrote to memory of 1908 1208 Payment_Advice.exe iexpress.exe PID 1208 wrote to memory of 1908 1208 Payment_Advice.exe iexpress.exe PID 1208 wrote to memory of 1908 1208 Payment_Advice.exe iexpress.exe PID 1208 wrote to memory of 1908 1208 Payment_Advice.exe iexpress.exe PID 1208 wrote to memory of 1908 1208 Payment_Advice.exe iexpress.exe PID 1208 wrote to memory of 1908 1208 Payment_Advice.exe iexpress.exe PID 1208 wrote to memory of 1908 1208 Payment_Advice.exe iexpress.exe PID 1208 wrote to memory of 1908 1208 Payment_Advice.exe iexpress.exe PID 1208 wrote to memory of 1908 1208 Payment_Advice.exe iexpress.exe PID 1208 wrote to memory of 1908 1208 Payment_Advice.exe iexpress.exe PID 1208 wrote to memory of 1908 1208 Payment_Advice.exe iexpress.exe PID 1208 wrote to memory of 1908 1208 Payment_Advice.exe iexpress.exe PID 1208 wrote to memory of 1908 1208 Payment_Advice.exe iexpress.exe PID 1208 wrote to memory of 1908 1208 Payment_Advice.exe iexpress.exe PID 1208 wrote to memory of 1908 1208 Payment_Advice.exe iexpress.exe PID 1208 wrote to memory of 1908 1208 Payment_Advice.exe iexpress.exe PID 1208 wrote to memory of 1908 1208 Payment_Advice.exe iexpress.exe PID 1908 wrote to memory of 1948 1908 iexpress.exe WerFault.exe PID 1908 wrote to memory of 1948 1908 iexpress.exe WerFault.exe PID 1908 wrote to memory of 1948 1908 iexpress.exe WerFault.exe PID 1908 wrote to memory of 1948 1908 iexpress.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payment_Advice.exe"C:\Users\Admin\AppData\Local\Temp\Payment_Advice.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\iexpress.exeC:\Windows\System32\iexpress.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 2923⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1208-54-0x0000000075D01000-0x0000000075D03000-memory.dmpFilesize
8KB
-
memory/1208-55-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-57-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-58-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-59-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-60-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-61-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-63-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-62-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-64-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-65-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-68-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-72-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-71-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-70-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-69-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-73-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-74-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-79-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-78-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-77-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-76-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-75-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-67-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-66-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-80-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-83-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-85-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-84-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-82-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-81-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-86-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-87-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-88-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-89-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-90-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-91-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-92-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-94-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-93-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-95-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-96-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-99-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-98-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-97-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-100-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-103-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-104-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-102-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-101-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-106-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-105-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-108-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-107-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-109-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-110-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-111-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-113-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-112-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-114-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-116-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-115-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1208-117-0x0000000000300000-0x000000000032A000-memory.dmpFilesize
168KB
-
memory/1908-120-0x0000000000000000-mapping.dmp
-
memory/1908-135-0x0000000010590000-0x0000000010613000-memory.dmpFilesize
524KB
-
memory/1908-138-0x0000000000A90000-0x0000000000B10000-memory.dmpFilesize
512KB
-
memory/1948-134-0x0000000000000000-mapping.dmp