modiloader | b4d144db0a51b75fec768e08ec6500afd3b085c0a9dd9b22926845536ec2a50d

General

Target

Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe
Size

1.4MB
MD5

ebbf1477570f9b7acccac1946a9a2099
SHA1

21b54ad89f6c5fcba305a586efc746b4f32bf1c3
SHA256

b4d144db0a51b75fec768e08ec6500afd3b085c0a9dd9b22926845536ec2a50d
SHA512

108db6d635c07c61222813518168216eef7b5669afed0cf65485bc28d72de92bb55258b032e3cbca474ce790cf0884c3d6689e17c2b744448fa840a9f613e26c
SSDEEP

24576:QzhCv4xm8E+fEc6tkt2SAaQ5/m9Qr/aZLkaf1mPqGyHvzU+XowdTH:QzZwaQ5/bx/+rXo4

Score

10^/10

modiloader remcos remotehost persistence rat trojan

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

top.never01abuse.xyz:4186

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmcoss-AS3COA
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4536-133-0x0000000002590000-0x0000000002677000-memory.dmp	modiloader_stage2

Blocklisted process makes network request 2 IoCs

Processes:

wscript.exe

flow pid process

26 4876 wscript.exe
30 4876 wscript.exe

flow	pid	process
26	4876	wscript.exe
30	4876	wscript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Zqsozefb = "C:\\Users\\Public\\Libraries\\bfezosqZ.url"	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe

pid process

4536 Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe
4536 Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe

pid	process
4536	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe
4536	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe

description	pid	process	target process
PID 4536 wrote to memory of 4876	4536	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe	wscript.exe
PID 4536 wrote to memory of 4876	4536	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe	wscript.exe
PID 4536 wrote to memory of 4876	4536	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe	wscript.exe
PID 4536 wrote to memory of 4876	4536	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe	wscript.exe
PID 4536 wrote to memory of 4876	4536	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe	wscript.exe
PID 4536 wrote to memory of 4876	4536	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe	wscript.exe
PID 4536 wrote to memory of 4876	4536	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe	wscript.exe
PID 4536 wrote to memory of 4876	4536	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe	wscript.exe
PID 4536 wrote to memory of 4876	4536	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe	wscript.exe
PID 4536 wrote to memory of 4876	4536	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe	wscript.exe
PID 4536 wrote to memory of 4876	4536	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe	wscript.exe
PID 4536 wrote to memory of 4876	4536	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe	wscript.exe
PID 4536 wrote to memory of 4876	4536	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe	wscript.exe
PID 4536 wrote to memory of 4876	4536	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe	wscript.exe
PID 4536 wrote to memory of 4876	4536	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe	wscript.exe
PID 4536 wrote to memory of 4876	4536	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe	wscript.exe
PID 4536 wrote to memory of 4876	4536	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe	wscript.exe

C:\Users\Admin\AppData\Local\Temp\Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe
"C:\Users\Admin\AppData\Local\Temp\Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4536

C:\Windows\SysWOW64\wscript.exe
C:\Windows\System32\wscript.exe
2⤵
- Blocklisted process makes network request
PID:4876

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4536-145-0x0000000010590000-0x000000001064F000-memory.dmp

Filesize
764KB

Download
memory/4536-135-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/4536-136-0x0000000000400000-0x0000000000572000-memory.dmp

Filesize
1.4MB

Download
memory/4536-139-0x0000000010590000-0x000000001064F000-memory.dmp

Filesize
764KB

Download
memory/4536-133-0x0000000002590000-0x0000000002677000-memory.dmp

Filesize
924KB

Download
memory/4876-148-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4876-141-0x0000000003DB0000-0x0000000003DB1000-memory.dmp

Filesize
4KB

Download
memory/4876-146-0x0000000003E10000-0x0000000003E11000-memory.dmp

Filesize
4KB

Download
memory/4876-140-0x0000000003C30000-0x0000000003C31000-memory.dmp

Filesize
4KB

Download
memory/4876-149-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4876-150-0x0000000010590000-0x000000001064F000-memory.dmp

Filesize
764KB

Download
memory/4876-151-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4876-152-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4876-153-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4876-154-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4876-157-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads