Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    20-09-2023 07:28

General

  • Target

    PO4102672345.rtf

  • Size

    345KB

  • MD5

    987971ef05bbf3bee0e5f0548cb53b64

  • SHA1

    8b961e75ab5fd688da06b1ade6ea1d2ed82fc3df

  • SHA256

    bbe10b8d55fd248651e7d483e82426fda7c4e2799461065d734858362e4bada8

  • SHA512

    e5eb25a662b986098e6657b0edf2bdcf7f3ebb75b03121ec92707332466178cf44570d55bd6e8b506e88ff9bef282efc75d6dd747fdfd387846dfdc59822bccb

  • SSDEEP

    768:jbOnDlKzboVm33/y3NZZ2sO3pv6o+qq60Vf7:jbsDUzbgmENZZ2sOx6o9q7Vf7

Malware Config

Extracted

Family

remcos

Botnet

ARAB

C2

tornado.ydns.eu:1972

orifak.ydns.eu:1972

wedhstinwell.online:1972

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    RmgDEfdfdef-8B9XCY

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • ModiLoader Second Stage 1 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\PO4102672345.rtf"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1284
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2208
    • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
      "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
      1⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Launches Equation Editor
      • Suspicious use of WriteProcessMemory
      PID:2780
      • C:\Users\Admin\AppData\Roaming\CHR0ME.scr
        C:\Users\Admin\AppData\Roaming\CHR0ME.scr
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2832
        • C:\Windows\SysWOW64\SndVol.exe
          C:\Windows\System32\SndVol.exe
          3⤵
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:2860

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Execution

    Exploitation for Client Execution

    1
    T1203

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Defense Evasion

    Modify Registry

    2
    T1112

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\CHR0ME.scr
      Filesize

      1.2MB

      MD5

      79b7474ded312cda4a0bd477ddf78378

      SHA1

      34c845c09dd73bd4bbd5b8ee6ebf9c9b3e6ff846

      SHA256

      3880c8403a1377ae8bbcc6f782e51839364c9e2e9e29ea9a02d011eeefd51d69

      SHA512

      d30600dd6b1b227f7a2fe4372389f9d34321ccc02886212332fb41613014a640ec22b3b16d70c100805a51b75bd89d5eb5482b1f07bcdcb2158981a2a7edd33c

    • C:\Users\Admin\AppData\Roaming\CHR0ME.scr
      Filesize

      1.2MB

      MD5

      79b7474ded312cda4a0bd477ddf78378

      SHA1

      34c845c09dd73bd4bbd5b8ee6ebf9c9b3e6ff846

      SHA256

      3880c8403a1377ae8bbcc6f782e51839364c9e2e9e29ea9a02d011eeefd51d69

      SHA512

      d30600dd6b1b227f7a2fe4372389f9d34321ccc02886212332fb41613014a640ec22b3b16d70c100805a51b75bd89d5eb5482b1f07bcdcb2158981a2a7edd33c

    • C:\Users\Admin\AppData\Roaming\CHR0ME.scr
      Filesize

      1.2MB

      MD5

      79b7474ded312cda4a0bd477ddf78378

      SHA1

      34c845c09dd73bd4bbd5b8ee6ebf9c9b3e6ff846

      SHA256

      3880c8403a1377ae8bbcc6f782e51839364c9e2e9e29ea9a02d011eeefd51d69

      SHA512

      d30600dd6b1b227f7a2fe4372389f9d34321ccc02886212332fb41613014a640ec22b3b16d70c100805a51b75bd89d5eb5482b1f07bcdcb2158981a2a7edd33c

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      ad42343d23bc9db51dad286b679125d7

      SHA1

      85335018b2836c9c2d425efcbb06e0d9627e2a1d

      SHA256

      5bc5c80b9f449e927412769405749bddb35b2b1188ba8a67f887dd5442ab8a50

      SHA512

      e16cfdabd83c6f737af7d9e6baa0af8ad0227eca6629a8df2988c47ae4ef7f8515d08ca8561a1bacc0c99bfc3f3ede987e01bcd2023dd09dad3facca22d73729

    • \Users\Admin\AppData\Roaming\CHR0ME.scr
      Filesize

      1.2MB

      MD5

      79b7474ded312cda4a0bd477ddf78378

      SHA1

      34c845c09dd73bd4bbd5b8ee6ebf9c9b3e6ff846

      SHA256

      3880c8403a1377ae8bbcc6f782e51839364c9e2e9e29ea9a02d011eeefd51d69

      SHA512

      d30600dd6b1b227f7a2fe4372389f9d34321ccc02886212332fb41613014a640ec22b3b16d70c100805a51b75bd89d5eb5482b1f07bcdcb2158981a2a7edd33c

    • \Users\Admin\AppData\Roaming\CHR0ME.scr
      Filesize

      1.2MB

      MD5

      79b7474ded312cda4a0bd477ddf78378

      SHA1

      34c845c09dd73bd4bbd5b8ee6ebf9c9b3e6ff846

      SHA256

      3880c8403a1377ae8bbcc6f782e51839364c9e2e9e29ea9a02d011eeefd51d69

      SHA512

      d30600dd6b1b227f7a2fe4372389f9d34321ccc02886212332fb41613014a640ec22b3b16d70c100805a51b75bd89d5eb5482b1f07bcdcb2158981a2a7edd33c

    • memory/1284-1-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/1284-2-0x00000000710AD000-0x00000000710B8000-memory.dmp
      Filesize

      44KB

    • memory/1284-71-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/1284-0-0x000000002FF01000-0x000000002FF02000-memory.dmp
      Filesize

      4KB

    • memory/1284-26-0x00000000710AD000-0x00000000710B8000-memory.dmp
      Filesize

      44KB

    • memory/2832-18-0x0000000002DF0000-0x0000000003DF0000-memory.dmp
      Filesize

      16.0MB

    • memory/2832-28-0x0000000000240000-0x0000000000241000-memory.dmp
      Filesize

      4KB

    • memory/2832-27-0x0000000000400000-0x0000000000535000-memory.dmp
      Filesize

      1.2MB

    • memory/2832-19-0x0000000002DF0000-0x0000000003DF0000-memory.dmp
      Filesize

      16.0MB

    • memory/2832-17-0x0000000000240000-0x0000000000241000-memory.dmp
      Filesize

      4KB

    • memory/2860-32-0x0000000000100000-0x0000000000101000-memory.dmp
      Filesize

      4KB

    • memory/2860-35-0x0000000000E40000-0x0000000000EC2000-memory.dmp
      Filesize

      520KB

    • memory/2860-39-0x0000000000E40000-0x0000000000EC2000-memory.dmp
      Filesize

      520KB

    • memory/2860-41-0x0000000000E40000-0x0000000000EC2000-memory.dmp
      Filesize

      520KB

    • memory/2860-42-0x0000000000E40000-0x0000000000EC2000-memory.dmp
      Filesize

      520KB

    • memory/2860-43-0x0000000000E40000-0x0000000000EC2000-memory.dmp
      Filesize

      520KB

    • memory/2860-48-0x0000000000100000-0x0000000000101000-memory.dmp
      Filesize

      4KB

    • memory/2860-49-0x0000000000E40000-0x0000000000EC2000-memory.dmp
      Filesize

      520KB

    • memory/2860-50-0x0000000000E40000-0x0000000000EC2000-memory.dmp
      Filesize

      520KB

    • memory/2860-51-0x0000000000E40000-0x0000000000EC2000-memory.dmp
      Filesize

      520KB

    • memory/2860-52-0x0000000000E40000-0x0000000000EC2000-memory.dmp
      Filesize

      520KB

    • memory/2860-34-0x0000000000E40000-0x0000000000EC2000-memory.dmp
      Filesize

      520KB

    • memory/2860-33-0x0000000002380000-0x0000000003380000-memory.dmp
      Filesize

      16.0MB

    • memory/2860-72-0x0000000000E40000-0x0000000000EC2000-memory.dmp
      Filesize

      520KB

    • memory/2860-73-0x0000000000E40000-0x0000000000EC2000-memory.dmp
      Filesize

      520KB