modiloader | 321f49f6fbc7d1e9199024cbcaf82d064f7e136ac3a24460d8ecb0552e6591a3

Analysis

max time kernel
159s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/01/2024, 10:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Rimessa Swift _Copy_Jan.exe
Size 2.0MB
Sample240131-mj3dmscaaq
SHA256 321f49f6fbc7d1e9199024cbcaf82d064f7e136ac3a24460d8ecb0552e6591a3
MD5 d3666a60392402ec968455fcb32ad50c
SHA1 ab8a65024abbe9df9e8a93c1e145e1d08c926d62
SHA512 b7db618d0d5e5244bbe3efad8b70be7e343f332011dc12b2e4070ae97f3d9a267c764d33092c24db05948d939fec3393439818e90e34e0b5c2e35e6044dc9993
SSDEEP 49152:pqAodhXjnxf2hd7c7mvrq0gOPcaF5P0R:pqAo2hd7Ymu0gONuR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader remcos remotehost collection persistence rat trojan

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

172.96.14.30:6871

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-KNH112
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/1116-2-0x0000000004150000-0x0000000005150000-memory.dmp	modiloader_stage2

NirSoft MailPassView 2 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/1236-26-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView
behavioral2/memory/1236-34-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/4872-23-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/4872-37-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 7 IoCs

resource	yara_rule
behavioral2/memory/1236-26-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft
behavioral2/memory/1236-34-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft
behavioral2/memory/4172-35-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/4172-30-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/4172-29-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/4872-23-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/4872-37-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	SndVol.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Fnmoautk = "C:\\Users\\Public\\Fnmoautk.url"	Rimessa Swift _Copy_Jan.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4716 set thread context of 4872	4716	SndVol.exe	92
PID 4716 set thread context of 1236	4716	SndVol.exe	93
PID 4716 set thread context of 4172	4716	SndVol.exe	95

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4780	4716	WerFault.exe	91

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	19	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4872	SndVol.exe
4872	SndVol.exe
4172	SndVol.exe
4172	SndVol.exe
4872	SndVol.exe
4872	SndVol.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
4716	SndVol.exe
4716	SndVol.exe
4716	SndVol.exe
4716	SndVol.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4172	SndVol.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 4716	1116	Rimessa Swift _Copy_Jan.exe	91
PID 1116 wrote to memory of 4716	1116	Rimessa Swift _Copy_Jan.exe	91
PID 1116 wrote to memory of 4716	1116	Rimessa Swift _Copy_Jan.exe	91
PID 1116 wrote to memory of 4716	1116	Rimessa Swift _Copy_Jan.exe	91
PID 4716 wrote to memory of 4872	4716	SndVol.exe	92
PID 4716 wrote to memory of 4872	4716	SndVol.exe	92
PID 4716 wrote to memory of 4872	4716	SndVol.exe	92
PID 4716 wrote to memory of 4872	4716	SndVol.exe	92
PID 4716 wrote to memory of 1236	4716	SndVol.exe	93
PID 4716 wrote to memory of 1236	4716	SndVol.exe	93
PID 4716 wrote to memory of 1236	4716	SndVol.exe	93
PID 4716 wrote to memory of 1236	4716	SndVol.exe	93
PID 4716 wrote to memory of 3640	4716	SndVol.exe	94
PID 4716 wrote to memory of 3640	4716	SndVol.exe	94
PID 4716 wrote to memory of 3640	4716	SndVol.exe	94
PID 4716 wrote to memory of 4172	4716	SndVol.exe	95
PID 4716 wrote to memory of 4172	4716	SndVol.exe	95
PID 4716 wrote to memory of 4172	4716	SndVol.exe	95
PID 4716 wrote to memory of 4172	4716	SndVol.exe	95

C:\Users\Admin\AppData\Local\Temp\Rimessa Swift _Copy_Jan.exe
"C:\Users\Admin\AppData\Local\Temp\Rimessa Swift _Copy_Jan.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Windows\SysWOW64\SndVol.exe
  C:\Windows\System32\SndVol.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\kwyiyqtfxlabfd"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4872
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\mymtrjezltsoqsllg"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:1236
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\xsrlrbpazbktsyhpphir"
    3⤵
    PID:3640
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\xsrlrbpazbktsyhpphir"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4172
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 1416
    3⤵
    - Program crash
    PID:4780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4716 -ip 4716
1⤵
PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

kwyiyqtfxlabfd

Path C:\Users\Admin\AppData\Local\Temp\kwyiyqtfxlabfd
Size 4KB
SHA256 439774341ec7cb11308989acce149b2b2d84ff071f449e228578863a8364fa31
MD5 36d8afcc508db22768f4a9d83187a515
SHA1 256cc1bf3150d1f0504ec452d67564d471617591
SHA512 3993d04cc39d50447e829ae8b36e04635a6fc3784bda73dacf9acc445a804d2659bdb79ff6f953a1e18f985ec39d6b1299a33aa836fdde45e02163faed2d6acf
SSDEEP 48:wvvv0NzxfvvcNzxfdvv0NzxBvv0Nzxakvv0Nz7:mvQxvop1vQPvQbvQ7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1116-1-0x0000000004150000-0x0000000005150000-memory.dmp

Download

memory/1116-2-0x0000000004150000-0x0000000005150000-memory.dmp

Download

memory/1116-4-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/1116-0-0x00000000023D0000-0x00000000023D1000-memory.dmp

Download

memory/1236-34-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/1236-17-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/1236-26-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/1236-21-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/4172-29-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4172-35-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4172-28-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4172-30-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4172-24-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4716-11-0x0000000000A60000-0x0000000001A60000-memory.dmp

Download

memory/4716-43-0x0000000000A60000-0x0000000001A60000-memory.dmp

Download

memory/4716-15-0x0000000000A60000-0x0000000001A60000-memory.dmp

Download

memory/4716-13-0x0000000000A60000-0x0000000001A60000-memory.dmp

Download

memory/4716-12-0x0000000000A60000-0x0000000001A60000-memory.dmp

Download

memory/4716-10-0x0000000000A60000-0x0000000001A60000-memory.dmp

Download

memory/4716-48-0x000000001ADA0000-0x000000001ADB9000-memory.dmp

Download

memory/4716-45-0x0000000000A60000-0x0000000001A60000-memory.dmp

Download

memory/4716-9-0x0000000000A60000-0x0000000001A60000-memory.dmp

Download

memory/4716-44-0x0000000000A60000-0x0000000001A60000-memory.dmp

Download

memory/4716-39-0x000000001ADA0000-0x000000001ADB9000-memory.dmp

Download

memory/4716-42-0x000000001ADA0000-0x000000001ADB9000-memory.dmp

Download

memory/4716-7-0x0000000000A60000-0x0000000001A60000-memory.dmp

Download

memory/4872-16-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4872-37-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4872-20-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4872-23-0x0000000000400000-0x0000000000478000-memory.dmp

Download