Overview

overview

10

Static

static

1

ADNOC UAE ...rm.exe

windows7-x64

10

ADNOC UAE ...rm.exe

windows10-2004-x64

10

ADNOC UAE ...OR.exe

windows7-x64

10

ADNOC UAE ...OR.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ADNOC-UAE-EOI-Acknowledgement_Form-with-VENDORS-AND-CONTRACTOR-ASSESSMENT-QUESTIONNAIRE.tar.lz

  • Size

    831KB

  • Sample

    230223-jj3gvsfb42

  • MD5

    6156f71ae49b554c47ed482d16f7f9b8

  • SHA1

    fa957471e6b6ff6de1f9aa43ffca742d478aba24

  • SHA256

    bf79eece904817da74a8d478d87d4eab7f8dc9788678c34a04d24f1bb907e0d1

  • SHA512

    59c26f6152a1be76c5f5d7f2e561a7996882cc415e9196eaf6d350d648bb1978459a62b1aa1a7c1997c947382baef43e7f3469f1bb8d7ab51767b109f39c7087

  • SSDEEP

    24576:DxFyf4f0oqvsR9AE9E85fOQxHBkvyagE2dV:DxYfrk/xEekwHV

Score
10/10
modiloaderremcosmixture-feb-2023collectionpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

remcos

Botnet

Mixture-Feb-2023

C2

pentester01.duckdns.org:53088

pentester0.accesscam.org:56796
Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    WeTransfer.exe

  • copy_folder

    WeTransfer

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    Wetransfer

  • mouse_option

    false

  • mutex

    Wetr-2B00YR

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    WeTransfer

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      ADNOC UAE EOI Acknowledgement_Form with VENDORS AND CONTRACTOR ASSESSMENT QUESTIONNAIRE/ADNOC UAE EOI Acknowledgement_Form.exe

    • Size

      38.1MB

    • MD5

      4ea8fa4b561e8e02dec82bb2f1d27dd9

    • SHA1

      12bd71ef9b6101a799e60504870e56a43f617e3a

    • SHA256

      05c15672fc9922839ac2f97c9cb82c788cd07950207663c69d0a675f4352d988

    • SHA512

      ef1c3459f2b28df4700f25dc965a85f021f98b39f018ce171bf24849043c6c60da516cbb569259dd767101d0c952002cead8176a5720a60237db8a928eb9c66a

    • SSDEEP

      12288:eu4PodWtXBGdM473moqdPO4ACBsH/LrZuWpnKlG40hryUOn38YvfPvfofHQsr0Sa:ZQoYBGdM4KoqPAPfXZuW0GS8YvfPvxu

    Score
    10/10
    modiloaderremcospersistencerattrojanmixture-feb-2023collectionspywarestealer

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • ModiLoader Second Stage

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      ADNOC UAE EOI Acknowledgement_Form with VENDORS AND CONTRACTOR ASSESSMENT QUESTIONNAIRE/ADNOC VENDORS AND CONTRACTOR ASSESSMENT QUESTIONNAIRE.exe

    • Size

      42.0MB

    • MD5

      036b133cc0c9d11c5e149cfc8b843d26

    • SHA1

      651bb20a6e7066590277a66779b00a8cc091d74a

    • SHA256

      713fa6ae0a53bb384b410fd88680056a9ef2689d54d141610afc07a63403e06e

    • SHA512

      249671477b67c99572ea146cc6b1b55f93d2453b62be642408f0cc6d5fa214d9d7502d5d98427fb3e443f9f73afe96f3f63048c28fb8f76a590a37ff79e35e34

    • SSDEEP

      12288:eu4PodWtXBGdM473moqdPO4ACBsH/LrZuWpnKlG40hryUOn38YffPvfofHQsr0Sa:ZQoYBGdM4KoqPAPfXZuW0GS8YffPvxu

    Score
    10/10
    modiloaderremcospersistencerattrojanmixture-feb-2023collectionspywarestealer

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • ModiLoader Second Stage

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

System Information Discovery

4
T1082

Query Registry

2
T1012

Remote System Discovery

2
T1018

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

2
T1114

Exfiltration

Command and Control

Web Service

2
T1102

Impact

Tasks