General
-
Target
SecuriteInfo.com.Win32.DropperX-gen.12909.29466.exe
-
Size
2.8MB
-
Sample
231128-nh9xrshf4y
-
MD5
347ad7f87b8007faa2db0c1032a60a85
-
SHA1
6fd3d2872613f5a622a5f25762dbed3440753894
-
SHA256
c7e18524730d00ad96155cb54beca97cc658f8bd94f736ef7671eadacd3ebee6
-
SHA512
81dfcf99f2113cde98b2e98eac0c15a5af57ed571da1ea168b3d17b4ff1da14abe9f2195adea3fe374cd45a932dff15a7ce3a3130b2008a109de3128bb087a3f
-
SSDEEP
49152:Xm/PpH8yc0/wU2lpe63ZrxKrVEbRIqiPt41zFehg1mQzZ:XOpcyV/wjpdZrxEVEtI14rqnY
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.DropperX-gen.12909.29466.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Win32.DropperX-gen.12909.29466.exe
Resource
win10v2004-20231127-en
Malware Config
Extracted
remcos
RemoteHost
127.0.0.1:45671
127.0.0.1:55677
192.3.101.8:55677
192.3.101.8:45671
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-2P1XPK
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
SecuriteInfo.com.Win32.DropperX-gen.12909.29466.exe
-
Size
2.8MB
-
MD5
347ad7f87b8007faa2db0c1032a60a85
-
SHA1
6fd3d2872613f5a622a5f25762dbed3440753894
-
SHA256
c7e18524730d00ad96155cb54beca97cc658f8bd94f736ef7671eadacd3ebee6
-
SHA512
81dfcf99f2113cde98b2e98eac0c15a5af57ed571da1ea168b3d17b4ff1da14abe9f2195adea3fe374cd45a932dff15a7ce3a3130b2008a109de3128bb087a3f
-
SSDEEP
49152:Xm/PpH8yc0/wU2lpe63ZrxKrVEbRIqiPt41zFehg1mQzZ:XOpcyV/wjpdZrxEVEtI14rqnY
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage
-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Nirsoft
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook accounts
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-