modiloader | de33fd9d4c89f8d5ffad69cb7743922d8d22f54890f9ca69161edce001cba9ad

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
29-05-2023 17:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Urgent Inquiry_Purchase order June 2023_PDF.exe
Size

1023KB
MD5

d25e61a090ba1f949df8e01c61301b6f
SHA1

082cea061e945c15812e123d40794031382d8eb8
SHA256

de33fd9d4c89f8d5ffad69cb7743922d8d22f54890f9ca69161edce001cba9ad
SHA512

eb952335eead9f188f49fd4e1c3930542c0ac449c6c2ad10d78257a41097468134a61459f2e1dd3fbf7921a365d921fde37dea30bbb0c46d130728f9d0f20d63
SSDEEP

12288:jRmIcCn67ZSgSZcKqe5aITzOFjHYsHlTs6EJqdvcFsymAkm4crYFoT:jR8zS0GTzA48InMvamcrYS

Score

10^/10

modiloader remcos remotehost collection persistence rat spyware stealer trojan

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

146.70.158.105:9138

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-EDGKM0
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/4076-134-0x0000000004360000-0x0000000004392000-memory.dmp	modiloader_stage2

NirSoft MailPassView 2 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/740-176-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView
behavioral2/memory/740-181-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 3 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/1824-173-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/1824-185-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/1824-187-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 7 IoCs

resource	yara_rule
behavioral2/memory/1824-173-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/3576-177-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/740-176-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft
behavioral2/memory/740-181-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft
behavioral2/memory/3576-183-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/1824-185-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/1824-187-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

Executes dropped EXE 4 IoCs

pid	Process
2012	ioccszmD.pif
1824	ioccszmD.pif
740	ioccszmD.pif
3576	ioccszmD.pif

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	ioccszmD.pif

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dmzsccoi = "C:\\Users\\Public\\Libraries\\ioccszmD.url"	Urgent Inquiry_Purchase order June 2023_PDF.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2012 set thread context of 1824	2012	ioccszmD.pif	86
PID 2012 set thread context of 740	2012	ioccszmD.pif	87
PID 2012 set thread context of 3576	2012	ioccszmD.pif	88

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	19	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	20	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	22	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1824	ioccszmD.pif
1824	ioccszmD.pif
3576	ioccszmD.pif
3576	ioccszmD.pif
1824	ioccszmD.pif
1824	ioccszmD.pif

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
2012	ioccszmD.pif
2012	ioccszmD.pif
2012	ioccszmD.pif

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3576	ioccszmD.pif

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 2012	4076	Urgent Inquiry_Purchase order June 2023_PDF.exe	85
PID 4076 wrote to memory of 2012	4076	Urgent Inquiry_Purchase order June 2023_PDF.exe	85
PID 4076 wrote to memory of 2012	4076	Urgent Inquiry_Purchase order June 2023_PDF.exe	85
PID 4076 wrote to memory of 2012	4076	Urgent Inquiry_Purchase order June 2023_PDF.exe	85
PID 4076 wrote to memory of 2012	4076	Urgent Inquiry_Purchase order June 2023_PDF.exe	85
PID 4076 wrote to memory of 2012	4076	Urgent Inquiry_Purchase order June 2023_PDF.exe	85
PID 4076 wrote to memory of 2012	4076	Urgent Inquiry_Purchase order June 2023_PDF.exe	85
PID 4076 wrote to memory of 2012	4076	Urgent Inquiry_Purchase order June 2023_PDF.exe	85
PID 4076 wrote to memory of 2012	4076	Urgent Inquiry_Purchase order June 2023_PDF.exe	85
PID 4076 wrote to memory of 2012	4076	Urgent Inquiry_Purchase order June 2023_PDF.exe	85
PID 4076 wrote to memory of 2012	4076	Urgent Inquiry_Purchase order June 2023_PDF.exe	85
PID 4076 wrote to memory of 2012	4076	Urgent Inquiry_Purchase order June 2023_PDF.exe	85
PID 4076 wrote to memory of 2012	4076	Urgent Inquiry_Purchase order June 2023_PDF.exe	85
PID 4076 wrote to memory of 2012	4076	Urgent Inquiry_Purchase order June 2023_PDF.exe	85
PID 4076 wrote to memory of 2012	4076	Urgent Inquiry_Purchase order June 2023_PDF.exe	85
PID 4076 wrote to memory of 2012	4076	Urgent Inquiry_Purchase order June 2023_PDF.exe	85
PID 4076 wrote to memory of 2012	4076	Urgent Inquiry_Purchase order June 2023_PDF.exe	85
PID 2012 wrote to memory of 1824	2012	ioccszmD.pif	86
PID 2012 wrote to memory of 1824	2012	ioccszmD.pif	86
PID 2012 wrote to memory of 1824	2012	ioccszmD.pif	86
PID 2012 wrote to memory of 740	2012	ioccszmD.pif	87
PID 2012 wrote to memory of 740	2012	ioccszmD.pif	87
PID 2012 wrote to memory of 740	2012	ioccszmD.pif	87
PID 2012 wrote to memory of 3576	2012	ioccszmD.pif	88
PID 2012 wrote to memory of 3576	2012	ioccszmD.pif	88
PID 2012 wrote to memory of 3576	2012	ioccszmD.pif	88

C:\Users\Admin\AppData\Local\Temp\Urgent Inquiry_Purchase order June 2023_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\Urgent Inquiry_Purchase order June 2023_PDF.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Users\Public\Libraries\ioccszmD.pif
  "C:\Users\Public\Libraries\ioccszmD.pif"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Users\Public\Libraries\ioccszmD.pif
    C:\Users\Public\Libraries\ioccszmD.pif /stext "C:\Users\Admin\AppData\Local\Temp\jegzdehvqgojuscwczpl"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1824
- - C:\Users\Public\Libraries\ioccszmD.pif
    C:\Users\Public\Libraries\ioccszmD.pif /stext "C:\Users\Admin\AppData\Local\Temp\tglsexroeogneyqaljcfuiwi"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook accounts
    PID:740
- - C:\Users\Public\Libraries\ioccszmD.pif
    C:\Users\Public\Libraries\ioccszmD.pif /stext "C:\Users\Admin\AppData\Local\Temp\vaycwpcqswzshemecupgfvrqatf"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3576

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\jegzdehvqgojuscwczpl

Filesize
4KB

MD5
33cb11983bebbd43f9ddfe8d26cf9a35

SHA1
f505ae1e507c227d9aafcf7f95fd6ccffd56e187

SHA256
568f3bb004b8a52e856fbf4630cd582f3e8452bb96377b5998fc97c0705d04d0

SHA512
4566580ecf0b95894bdbe5a1288743509052cfa13b1f53da8fc524779a404e893b1846218ba0027309d3c7c987478123cf0381c2abff658cf179b53b6a06b5f6

Download Submit
C:\Users\Public\Libraries\ioccszmD.pif

Filesize
66KB

MD5
c116d3604ceafe7057d77ff27552c215

SHA1
452b14432fb5758b46f2897aeccd89f7c82a727d

SHA256
7bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301

SHA512
9202a00eeaf4c5be94de32fd41bfea40fc32d368955d49b7bad2b5c23c4ebc92dccb37d99f5a14e53ad674b63f1baa6efb1feb27225c86693ead3262a26d66c6

Download Submit
C:\Users\Public\Libraries\ioccszmD.pif

Filesize
66KB

MD5
c116d3604ceafe7057d77ff27552c215

SHA1
452b14432fb5758b46f2897aeccd89f7c82a727d

SHA256
7bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301

SHA512
9202a00eeaf4c5be94de32fd41bfea40fc32d368955d49b7bad2b5c23c4ebc92dccb37d99f5a14e53ad674b63f1baa6efb1feb27225c86693ead3262a26d66c6

Download Submit
C:\Users\Public\Libraries\ioccszmD.pif

Filesize
66KB

MD5
c116d3604ceafe7057d77ff27552c215

SHA1
452b14432fb5758b46f2897aeccd89f7c82a727d

SHA256
7bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301

SHA512
9202a00eeaf4c5be94de32fd41bfea40fc32d368955d49b7bad2b5c23c4ebc92dccb37d99f5a14e53ad674b63f1baa6efb1feb27225c86693ead3262a26d66c6

Download Submit
C:\Users\Public\Libraries\ioccszmD.pif

Filesize
66KB

MD5
c116d3604ceafe7057d77ff27552c215

SHA1
452b14432fb5758b46f2897aeccd89f7c82a727d

SHA256
7bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301

SHA512
9202a00eeaf4c5be94de32fd41bfea40fc32d368955d49b7bad2b5c23c4ebc92dccb37d99f5a14e53ad674b63f1baa6efb1feb27225c86693ead3262a26d66c6

Download Submit
C:\Users\Public\Libraries\ioccszmD.pif

Filesize
66KB

MD5
c116d3604ceafe7057d77ff27552c215

SHA1
452b14432fb5758b46f2897aeccd89f7c82a727d

SHA256
7bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301

SHA512
9202a00eeaf4c5be94de32fd41bfea40fc32d368955d49b7bad2b5c23c4ebc92dccb37d99f5a14e53ad674b63f1baa6efb1feb27225c86693ead3262a26d66c6

Download Submit
memory/740-176-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/740-181-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/740-174-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/740-165-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1824-185-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1824-163-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1824-173-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1824-170-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1824-187-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2012-155-0x00000000105A0000-0x0000000010667000-memory.dmp

Filesize
796KB

Download
memory/2012-196-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2012-160-0x0000000000630000-0x00000000006B1000-memory.dmp

Filesize
516KB

Download
memory/2012-162-0x0000000000630000-0x00000000006B1000-memory.dmp

Filesize
516KB

Download
memory/2012-158-0x0000000000630000-0x00000000006B1000-memory.dmp

Filesize
516KB

Download
memory/2012-157-0x0000000000630000-0x00000000006B1000-memory.dmp

Filesize
516KB

Download
memory/2012-156-0x0000000000630000-0x00000000006B1000-memory.dmp

Filesize
516KB

Download
memory/2012-214-0x0000000000630000-0x00000000006B1000-memory.dmp

Filesize
516KB

Download
memory/2012-154-0x0000000000630000-0x00000000006B1000-memory.dmp

Filesize
516KB

Download
memory/2012-153-0x0000000000630000-0x00000000006B1000-memory.dmp

Filesize
516KB

Download
memory/2012-213-0x0000000000630000-0x00000000006B1000-memory.dmp

Filesize
516KB

Download
memory/2012-209-0x0000000000630000-0x00000000006B1000-memory.dmp

Filesize
516KB

Download
memory/2012-151-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/2012-208-0x0000000000630000-0x00000000006B1000-memory.dmp

Filesize
516KB

Download
memory/2012-145-0x0000000000580000-0x0000000000581000-memory.dmp

Filesize
4KB

Download
memory/2012-204-0x0000000000630000-0x00000000006B1000-memory.dmp

Filesize
516KB

Download
memory/2012-143-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2012-203-0x0000000000630000-0x00000000006B1000-memory.dmp

Filesize
516KB

Download
memory/2012-199-0x0000000000630000-0x00000000006B1000-memory.dmp

Filesize
516KB

Download
memory/2012-198-0x0000000000630000-0x00000000006B1000-memory.dmp

Filesize
516KB

Download
memory/2012-197-0x0000000000630000-0x00000000006B1000-memory.dmp

Filesize
516KB

Download
memory/2012-190-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2012-193-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2012-194-0x0000000000630000-0x00000000006B1000-memory.dmp

Filesize
516KB

Download
memory/2012-195-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2012-159-0x0000000000630000-0x00000000006B1000-memory.dmp

Filesize
516KB

Download
memory/3576-183-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3576-167-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3576-177-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3576-175-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4076-134-0x0000000004360000-0x0000000004392000-memory.dmp

Filesize
200KB

Download
memory/4076-136-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/4076-142-0x00000000105A0000-0x0000000010667000-memory.dmp

Filesize
796KB

Download
memory/4076-150-0x00000000105A0000-0x0000000010667000-memory.dmp

Filesize
796KB

Download
memory/4076-133-0x00000000022B0000-0x00000000022B1000-memory.dmp

Filesize
4KB

Download