modiloader | 8bf1fc90c21adb2347d38ce1f6d9889ae42ac88a5a0c0b96f1baea8013a305c0

General

Target

8bf1fc90c21adb2347d38ce1f6d9889ae42ac88a5a0c0b96f1baea8013a305c0.exe
Size

888KB
MD5

b9ab69a9cadc7a0e054cbc3f91b3d76e
SHA1

feee2f1932b35fe1b1fd358bdc824c482e4a1d51
SHA256

8bf1fc90c21adb2347d38ce1f6d9889ae42ac88a5a0c0b96f1baea8013a305c0
SHA512

3d607577a4320651898b1135decba0cf391d8f935c94cf5e087356c8e08ad4da4c6cdcc71cf3663c2086b38165dcc73a070d50e78909bae6ed6054d231fbf411
SSDEEP

12288:oXxu5oy0XhL9ljnp9zIO6S33Ys1fCjPfeCMVAgfMCfLe9:ohAcXhL9lV9cHSY2ZCMVAgfM

Score

10^/10

modiloader remcos remotehost persistence rat trojan

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

newpage44.mywire.org:5010

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
adode.exe
copy_folder
Skype
delete_file
true
hide_file
true
hide_keylog_file
false
install_flag
true
install_path
%Temp%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-3N0E9G
screenshot_crypt
false
screenshot_flag
true
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/4668-3-0x00000000028F0000-0x00000000038F0000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
1156	adode.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-3N0E9G = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Skype\\adode.exe\""	SndVol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-3N0E9G = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Skype\\adode.exe\""	SndVol.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Aggtoxhy = "C:\\Users\\Public\\Aggtoxhy.url"	8bf1fc90c21adb2347d38ce1f6d9889ae42ac88a5a0c0b96f1baea8013a305c0.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	SndVol.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	50	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	45	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4668	8bf1fc90c21adb2347d38ce1f6d9889ae42ac88a5a0c0b96f1baea8013a305c0.exe
4668	8bf1fc90c21adb2347d38ce1f6d9889ae42ac88a5a0c0b96f1baea8013a305c0.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1256	SndVol.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1256	SndVol.exe
1256	SndVol.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4668 wrote to memory of 3224	4668	8bf1fc90c21adb2347d38ce1f6d9889ae42ac88a5a0c0b96f1baea8013a305c0.exe	110
PID 4668 wrote to memory of 3224	4668	8bf1fc90c21adb2347d38ce1f6d9889ae42ac88a5a0c0b96f1baea8013a305c0.exe	110
PID 4668 wrote to memory of 3224	4668	8bf1fc90c21adb2347d38ce1f6d9889ae42ac88a5a0c0b96f1baea8013a305c0.exe	110
PID 4668 wrote to memory of 1256	4668	8bf1fc90c21adb2347d38ce1f6d9889ae42ac88a5a0c0b96f1baea8013a305c0.exe	111
PID 4668 wrote to memory of 1256	4668	8bf1fc90c21adb2347d38ce1f6d9889ae42ac88a5a0c0b96f1baea8013a305c0.exe	111
PID 4668 wrote to memory of 1256	4668	8bf1fc90c21adb2347d38ce1f6d9889ae42ac88a5a0c0b96f1baea8013a305c0.exe	111
PID 4668 wrote to memory of 1256	4668	8bf1fc90c21adb2347d38ce1f6d9889ae42ac88a5a0c0b96f1baea8013a305c0.exe	111
PID 1256 wrote to memory of 1156	1256	SndVol.exe	115
PID 1256 wrote to memory of 1156	1256	SndVol.exe	115
PID 1256 wrote to memory of 1156	1256	SndVol.exe	115

C:\Users\Admin\AppData\Local\Temp\8bf1fc90c21adb2347d38ce1f6d9889ae42ac88a5a0c0b96f1baea8013a305c0.exe
"C:\Users\Admin\AppData\Local\Temp\8bf1fc90c21adb2347d38ce1f6d9889ae42ac88a5a0c0b96f1baea8013a305c0.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Windows\SysWOW64\extrac32.exe
  C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Admin\AppData\Local\Temp\8bf1fc90c21adb2347d38ce1f6d9889ae42ac88a5a0c0b96f1baea8013a305c0.exe C:\\Users\\Public\\Libraries\\Aggtoxhy.PIF
  2⤵
  PID:3224
- C:\Windows\SysWOW64\SndVol.exe
  C:\Windows\System32\SndVol.exe
  2⤵
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1256
- - C:\Users\Admin\AppData\Local\Temp\Skype\adode.exe
    "C:\Users\Admin\AppData\Local\Temp\Skype\adode.exe"
    3⤵
    - Executes dropped EXE
    PID:1156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1316 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:4608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Skype\adode.exe

Filesize
220KB

MD5
5ac83d3d18f9b6e1c5b78bd712661524

SHA1
9ee22c8038e47a4935aeac113d3f2ee6f03a22c4

SHA256
d68ddc4be84705357288ba972939aa9aa5f95537ebc059c3ff3ccaae11638fca

SHA512
2fc37b27836a4f0a4c61a5cd976e7452120585b86a615cce25108737337a9a02b73cc68c92b26fbb89a5cadbf3033ad0b6355cc5b7094f18318e3dbea1b84082

Download Submit
memory/1256-14-0x0000000002BE0000-0x0000000003BE0000-memory.dmp

Filesize
16.0MB

Download
memory/1256-16-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1256-76-0x0000000002BE0000-0x0000000003BE0000-memory.dmp

Filesize
16.0MB

Download
memory/1256-77-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4668-0-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/4668-1-0x0000000000680000-0x0000000000681000-memory.dmp

Filesize
4KB

Download
memory/4668-2-0x00000000028F0000-0x00000000038F0000-memory.dmp

Filesize
16.0MB

Download
memory/4668-3-0x00000000028F0000-0x00000000038F0000-memory.dmp

Filesize
16.0MB

Download
memory/4668-5-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/4668-7-0x0000000000680000-0x0000000000681000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads