modiloader | b4d144db0a51b75fec768e08ec6500afd3b085c0a9dd9b22926845536ec2a50d

General

Target

Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe
Size

1.4MB
MD5

ebbf1477570f9b7acccac1946a9a2099
SHA1

21b54ad89f6c5fcba305a586efc746b4f32bf1c3
SHA256

b4d144db0a51b75fec768e08ec6500afd3b085c0a9dd9b22926845536ec2a50d
SHA512

108db6d635c07c61222813518168216eef7b5669afed0cf65485bc28d72de92bb55258b032e3cbca474ce790cf0884c3d6689e17c2b744448fa840a9f613e26c
SSDEEP

24576:QzhCv4xm8E+fEc6tkt2SAaQ5/m9Qr/aZLkaf1mPqGyHvzU+XowdTH:QzZwaQ5/bx/+rXo4

Score

10^/10

modiloader remcos remotehost persistence rat trojan

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

top.never01abuse.xyz:4186

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmcoss-AS3COA
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4632-134-0x00000000046B0000-0x0000000004797000-memory.dmp	modiloader_stage2

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Zqsozefb = "C:\\Users\\Public\\Libraries\\bfezosqZ.url"	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

752 3624 WerFault.exe wscript.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe

pid process

4632 Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe
4632 Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe

pid	pid_target	process	target process
752	3624	WerFault.exe	wscript.exe

pid	process
4632	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe
4632	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe

description	pid	process	target process
PID 4632 wrote to memory of 3624	4632	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe	wscript.exe
PID 4632 wrote to memory of 3624	4632	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe	wscript.exe
PID 4632 wrote to memory of 3624	4632	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe	wscript.exe
PID 4632 wrote to memory of 3624	4632	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe	wscript.exe
PID 4632 wrote to memory of 3624	4632	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe	wscript.exe
PID 4632 wrote to memory of 3624	4632	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe	wscript.exe
PID 4632 wrote to memory of 3624	4632	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe	wscript.exe
PID 4632 wrote to memory of 3624	4632	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe	wscript.exe
PID 4632 wrote to memory of 3624	4632	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe	wscript.exe
PID 4632 wrote to memory of 3624	4632	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe	wscript.exe
PID 4632 wrote to memory of 3624	4632	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe	wscript.exe
PID 4632 wrote to memory of 3624	4632	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe	wscript.exe
PID 4632 wrote to memory of 3624	4632	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe	wscript.exe
PID 4632 wrote to memory of 3624	4632	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe	wscript.exe
PID 4632 wrote to memory of 3624	4632	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe	wscript.exe
PID 4632 wrote to memory of 3624	4632	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe	wscript.exe
PID 4632 wrote to memory of 3624	4632	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe	wscript.exe

C:\Users\Admin\AppData\Local\Temp\Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe
"C:\Users\Admin\AppData\Local\Temp\Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4632

C:\Windows\SysWOW64\wscript.exe
C:\Windows\System32\wscript.exe
2⤵
PID:3624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 848
3⤵
- Program crash
PID:752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3624 -ip 3624
1⤵
PID:3044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3624-140-0x0000000000810000-0x0000000000811000-memory.dmp

Filesize
4KB

Download
memory/3624-141-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/3624-146-0x0000000002390000-0x0000000002391000-memory.dmp

Filesize
4KB

Download
memory/3624-148-0x0000000010590000-0x000000001064F000-memory.dmp

Filesize
764KB

Download
memory/3624-149-0x00000000036E0000-0x000000000375C000-memory.dmp

Filesize
496KB

Download
memory/4632-133-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download
memory/4632-134-0x00000000046B0000-0x0000000004797000-memory.dmp

Filesize
924KB

Download
memory/4632-136-0x0000000000400000-0x0000000000572000-memory.dmp

Filesize
1.4MB

Download
memory/4632-139-0x0000000010590000-0x000000001064F000-memory.dmp

Filesize
764KB

Download
memory/4632-145-0x0000000010590000-0x000000001064F000-memory.dmp

Filesize
764KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads