modiloader | 8cde60f804a160f6fdaf788a4ba9a885cf178cebe4829eafbcd3fa1fb5a78185

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2023, 05:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
Size 1.1MB
Sample231002-ft9r5sha84
SHA256 8cde60f804a160f6fdaf788a4ba9a885cf178cebe4829eafbcd3fa1fb5a78185
MD5 24c8ce3fb8ef860ffbc2d6bb270e06f6
SHA1 e0cd033aa94f070243e4b8bca5e4b7d7e075ea78
SHA512 5016ba0da8d862e5a384f2860c1c597d92a4742a626d54cf02eaa90fa3aee0a6372aa5a1f8cb1d6a27dc5ff4aa5948ac857b15799a7582c69c098ab45b58f6e1
SSDEEP 12288:qE8C9kdWdEPv8zuVEdh9a6OLqvabdpmBkt1VEmA00P85Be2fgmv1qsM8HcZG3g55:qEPudPPOuVsaoAjlD0P83H5M8OG3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader remcos new collection persistence rat trojan

Malware Config

Extracted

Family

remcos

Botnet

remcos1.ydns.eu:1988

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmcjhgf-MG50WE
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/1996-1-0x0000000002B40000-0x0000000003B40000-memory.dmp	modiloader_stage2

NirSoft MailPassView 2 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/3428-36-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView
behavioral2/memory/3428-40-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/4980-29-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/4980-43-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 6 IoCs

resource	yara_rule
behavioral2/memory/4980-29-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/3428-36-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft
behavioral2/memory/3428-40-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft
behavioral2/memory/4516-39-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/4516-41-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/4980-43-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	colorcpl.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Msvsrlgk = "C:\\Users\\Public\\Msvsrlgk.url"	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3388 set thread context of 4980	3388	colorcpl.exe	97
PID 3388 set thread context of 3428	3388	colorcpl.exe	98
PID 3388 set thread context of 4516	3388	colorcpl.exe	101

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1648	3388	WerFault.exe	96

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	56	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	62	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
4980	colorcpl.exe
4980	colorcpl.exe
4516	colorcpl.exe
4516	colorcpl.exe
4980	colorcpl.exe
4980	colorcpl.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
3388	colorcpl.exe
3388	colorcpl.exe
3388	colorcpl.exe
3388	colorcpl.exe
3388	colorcpl.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4516	colorcpl.exe
Token: SeManageVolumePrivilege	5116	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
PID 1996 wrote to memory of 0	1996	24c8ce3fb8ef860ffbc2d6bb270e06f6.exe

C:\Users\Admin\AppData\Local\Temp\24c8ce3fb8ef860ffbc2d6bb270e06f6.exe
"C:\Users\Admin\AppData\Local\Temp\24c8ce3fb8ef860ffbc2d6bb270e06f6.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\colorcpl.exe
  C:\Windows\System32\colorcpl.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  PID:3388
- - C:\Windows\SysWOW64\colorcpl.exe
    C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\Admin\AppData\Local\Temp\vsuxj"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4980
- - C:\Windows\SysWOW64\colorcpl.exe
    C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\Admin\AppData\Local\Temp\xuipkqsk"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:3428
- - C:\Windows\SysWOW64\colorcpl.exe
    C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\Admin\AppData\Local\Temp\ipnaljdertfd"
    3⤵
    PID:5084
- - C:\Windows\SysWOW64\colorcpl.exe
    C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\Admin\AppData\Local\Temp\ipnaljdertfd"
    3⤵
    PID:1148
- - C:\Windows\SysWOW64\colorcpl.exe
    C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\Admin\AppData\Local\Temp\ipnaljdertfd"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4516
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3388 -s 1304
    3⤵
    - Program crash
    PID:1648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3388 -ip 3388
1⤵
PID:4144

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:1552

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

store.jfm

Path C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm
Size 16KB
SHA256 77a1c2009fa4daff0e959e3c208014df40688e6a29aa2144ca2fc714527b60f0
MD5 270aba0cb556759e98aa2423b7ae07ac
SHA1 51eef7554ec9d1e621a0e94b9868b7f387ae6659
SHA512 d3711062e6683db98ce73e021c995b3f1e3ed3c9da6aee22ebd2c5cde1a931ad7e4b250565056f1ac5453cc5890f07d56e41192274e0aaffc34150accc8fb2ed
SSDEEP 6:alElYnjX64gukW/nQUTdRQERfhF2LD/aWktWWWwvl6vl+ekOi95D/rUATe/4+fba:aylYjXzguT/DySE/Yxv8OT/rU
MD5 SHA1 SHA512 SSDEEP

Submit Download

vsuxj

Path C:\Users\Admin\AppData\Local\Temp\vsuxj
Size 4KB
SHA256 085e41325891f7cea84e942500532a18057ff766dd54ef67ff6b08f133e5d54a
MD5 54256016ad499fd79eec3ef68594cace
SHA1 070a70ae09608ff5df35f26736a583476b35c59a
SHA512 8507d35255335ce453e679cc2da2481d246b41be2fdcca718e403db6c2676394dcc848cdde07e5fff0396dd5de5e4444dbd57394a99cc1e337f23fac34ded269
SSDEEP 48:wvvv0PMxfvvcPMxfdvv0PMxBvv0PMxakvv0PM7:mvNxvVp1vNPvNbvN7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1996-0-0x0000000000710000-0x0000000000711000-memory.dmp

Download

memory/1996-1-0x0000000002B40000-0x0000000003B40000-memory.dmp

Download

memory/1996-3-0x0000000000400000-0x000000000051A000-memory.dmp

Download

memory/1996-4-0x0000000000710000-0x0000000000711000-memory.dmp

Download

memory/3388-15-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3388-55-0x0000000011140000-0x0000000011159000-memory.dmp

Download

memory/3388-13-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3388-10-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3388-16-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3388-17-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3388-18-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3388-21-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3388-7-0x0000000004810000-0x0000000005810000-memory.dmp

Download

memory/3388-8-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3388-54-0x0000000004810000-0x0000000005810000-memory.dmp

Download

memory/3388-50-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3388-45-0x0000000011140000-0x0000000011159000-memory.dmp

Download

memory/3388-48-0x0000000011140000-0x0000000011159000-memory.dmp

Download

memory/3388-11-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3428-36-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/3428-31-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/3428-40-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/3428-23-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/3428-27-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/4516-37-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4516-41-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4516-39-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4516-30-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4980-43-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4980-29-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4980-26-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4980-22-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/5116-56-0x00000266FFEA0000-0x00000266FFEB0000-memory.dmp

Download

memory/5116-72-0x0000026681410000-0x0000026681420000-memory.dmp

Download