General
-
Target
DOC20220513PRELIMINARC0559DOC03027321122021JIHG25485.xz
-
Size
329KB
-
Sample
230417-r8zq9sef65
-
MD5
b6d4c60c5fe56c29edb9f955d553956c
-
SHA1
e056c40acd04b4173629bb48b00ea6bd6f35b580
-
SHA256
fab09d9c5d9eca4e88057d9cb3726fd266b45c22005dcfcb20c29f69b76e27c2
-
SHA512
d1dd7645a38a7e6b9042cda1b1ef672584ba6fec8c65cf074a956f15075f7ea8ffa42183dcdf682238e63c69c299cf4b1dfd2f97108db62ec2ee9506cb173687
-
SSDEEP
6144:6A3VQ4k5zYHxg+NPF/G/d1XwmJ/E7iI5YzcYXbtbhpEKK:6Y5PPF/G/Ei/E7VYzcMbRK
Static task
static1
Behavioral task
behavioral1
Sample
DOC20220513PRELIMINARC0559DOC03027321122021JIHG25485/DOC20220513PRELIMINARC0559DOC03027321122021JIHG25485.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
DOC20220513PRELIMINARC0559DOC03027321122021JIHG25485/DOC20220513PRELIMINARC0559DOC03027321122021JIHG25485.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
remcos
RECOVERY
www.nwconstructions.us:28364
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
wsdeeqd-37I9H7
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
DOC20220513PRELIMINARC0559DOC03027321122021JIHG25485/DOC20220513PRELIMINARC0559DOC03027321122021JIHG25485.exe
-
Size
703KB
-
MD5
5a31570b30fa56e33e28cc201e59d8e8
-
SHA1
d7f19a95e279a2b7826ab582db777f6bb0c482cc
-
SHA256
4f012f2840544e354fa24d1971883acd2c8ef9fcbfeec7811c016de5549e45a9
-
SHA512
32bf73353592341a555b66068775a43b8d2a38b10009d67cedba0b4269d9814e645048cf6dab2bd3449f7ab6902d5891922d0e3d9a95815dc0dcd228b6db8496
-
SSDEEP
12288:gkI303av+MZO0bfKIosoFwewOfyaEzjOol:gkGv+MZOxpFLwOqaEvO
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-