Analysis Overview
SHA256
373859f19da9662cebadea97fe4acf12e811b72acb5490d80c7f0d8ff45353a3
Threat Level: Known bad
The file PI-BD2403001.exe was found to be: Known bad.
Malicious Activity Summary
Remcos
ModiLoader, DBatLoader
ModiLoader Second Stage
Loads dropped DLL
Executes dropped EXE
Adds Run key to start application
Unsigned PE
Program crash
Script User-Agent
Suspicious use of SetWindowsHookEx
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-03-26 12:53
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-03-26 12:53
Reported
2024-03-26 12:55
Platform
win7-20240221-en
Max time kernel
131s
Max time network
139s
Command Line
Signatures
ModiLoader, DBatLoader
ModiLoader Second Stage
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\PI-BD2403001.exe |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 3008 wrote to memory of 2692 | N/A | C:\Users\Admin\AppData\Local\Temp\PI-BD2403001.exe | C:\Windows\SysWOW64\WerFault.exe |
| PID 3008 wrote to memory of 2692 | N/A | C:\Users\Admin\AppData\Local\Temp\PI-BD2403001.exe | C:\Windows\SysWOW64\WerFault.exe |
| PID 3008 wrote to memory of 2692 | N/A | C:\Users\Admin\AppData\Local\Temp\PI-BD2403001.exe | C:\Windows\SysWOW64\WerFault.exe |
| PID 3008 wrote to memory of 2692 | N/A | C:\Users\Admin\AppData\Local\Temp\PI-BD2403001.exe | C:\Windows\SysWOW64\WerFault.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\PI-BD2403001.exe
"C:\Users\Admin\AppData\Local\Temp\PI-BD2403001.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 716
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 1021.filemail.com | udp |
| US | 23.237.82.74:443 | 1021.filemail.com | tcp |
| US | 23.237.82.74:443 | 1021.filemail.com | tcp |
Files
memory/3008-0-0x0000000000230000-0x0000000000231000-memory.dmp
memory/3008-1-0x0000000002C50000-0x0000000003C50000-memory.dmp
memory/3008-2-0x0000000002C50000-0x0000000003C50000-memory.dmp
memory/3008-4-0x0000000000230000-0x0000000000231000-memory.dmp
memory/3008-5-0x0000000000400000-0x0000000000527000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-03-26 12:53
Reported
2024-03-26 12:55
Platform
win10v2004-20240226-en
Max time kernel
150s
Max time network
155s
Command Line
Signatures
ModiLoader, DBatLoader
Remcos
ModiLoader Second Stage
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows \System32\1417119.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows \System32\1417119.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Qbijgrcm = "C:\\Users\\Public\\Qbijgrcm.url" | C:\Users\Admin\AppData\Local\Temp\PI-BD2403001.exe | N/A |
Script User-Agent
| Description | Indicator | Process | Target |
| HTTP User-Agent header | Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) | N/A | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\SndVol.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\PI-BD2403001.exe
"C:\Users\Admin\AppData\Local\Temp\PI-BD2403001.exe"
C:\Windows\SysWOW64\cmd.exe
cmd /c mkdir "\\?\C:\Windows "
C:\Windows\SysWOW64\cmd.exe
cmd /c mkdir "\\?\C:\Windows \System32"
C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Windows \System32\1417119.exe"
C:\Windows \System32\1417119.exe
"C:\Windows \System32\1417119.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\windows \system32\KDECO.bat""
C:\Windows\system32\cmd.exe
cmd /c powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
C:\Windows\SysWOW64\extrac32.exe
C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Admin\AppData\Local\Temp\PI-BD2403001.exe C:\\Users\\Public\\Libraries\\Qbijgrcm.PIF
C:\Windows\SysWOW64\SndVol.exe
C:\Windows\System32\SndVol.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 17.53.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.200:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 29.179.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 1021.filemail.com | udp |
| US | 23.237.82.74:443 | 1021.filemail.com | tcp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 23.237.82.74:443 | 1021.filemail.com | tcp |
| US | 8.8.8.8:53 | 74.82.237.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| N/A | 127.0.0.1:47212 | tcp | |
| US | 8.8.8.8:53 | officerem.duckdns.org | udp |
| US | 23.95.235.29:47212 | officerem.duckdns.org | tcp |
| US | 8.8.8.8:53 | 29.235.95.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | geoplugin.net | udp |
| NL | 178.237.33.50:80 | geoplugin.net | tcp |
| US | 8.8.8.8:53 | 50.33.237.178.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.134.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 100.5.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 119.110.54.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 37.179.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 64.134.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 205.47.74.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 19.229.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 32.179.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 90.135.221.88.in-addr.arpa | udp |
| GB | 96.17.179.32:80 | tcp |
Files
memory/1640-0-0x0000000000830000-0x0000000000831000-memory.dmp
memory/1640-1-0x0000000003F60000-0x0000000004F60000-memory.dmp
memory/1640-2-0x0000000003F60000-0x0000000004F60000-memory.dmp
memory/1640-4-0x0000000000400000-0x0000000000527000-memory.dmp
C:\Windows \System32\1417119.exe
| MD5 | 231ce1e1d7d98b44371ffff407d68b59 |
| SHA1 | 25510d0f6353dbf0c9f72fc880de7585e34b28ff |
| SHA256 | 30951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96 |
| SHA512 | 520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612 |
C:\Windows \System32\netutils.dll
| MD5 | fa7aa88417d0c48807144a1a48fe3fbc |
| SHA1 | 6f5ec990b12d4a6075050a94e0d68d03781fa46d |
| SHA256 | 2019dcd18ba7d5554a4a9da882740aa883941670af3de9396960081a0f8aa098 |
| SHA512 | 99b2eb6f8e7d00a3803cba229149e5e0cb67a3deb607782c55fbacd25d9c074cce83759de15490eff939d5ad98f26cdbd44395cc79ffe22753e16c3d9e3b5fff |
memory/5104-16-0x00000000613C0000-0x00000000613E3000-memory.dmp
C:\windows \system32\KDECO.bat
| MD5 | c545650595b479c81ad6b9d8882aae39 |
| SHA1 | 7a98aa2e6eee23b3c1bba876955d525bc618b3f0 |
| SHA256 | a3a80983cb33159f0455fa0135789402558baa1460db94d0071318512b8cb5f9 |
| SHA512 | 85ac596a7da9072a28c4178e4fdedc98f1b49c8e3fe5612cfe464833297b13f65d2dc59b52d7fc9970cff8f98d954111229aec0ed9dded454e03b0cf4ebb6ff3 |
memory/1640-18-0x0000000000830000-0x0000000000831000-memory.dmp
memory/2716-28-0x000001555A130000-0x000001555A152000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xgoxzufo.r3g.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/2716-29-0x00007FFCD3970000-0x00007FFCD4431000-memory.dmp
memory/2716-30-0x000001555A1F0000-0x000001555A200000-memory.dmp
memory/2716-31-0x000001555A1F0000-0x000001555A200000-memory.dmp
memory/2716-34-0x00007FFCD3970000-0x00007FFCD4431000-memory.dmp
memory/924-41-0x0000000000D40000-0x0000000001D40000-memory.dmp
memory/924-43-0x0000000000D40000-0x0000000001D40000-memory.dmp
memory/924-44-0x0000000000D40000-0x0000000001D40000-memory.dmp
memory/924-45-0x0000000000D40000-0x0000000001D40000-memory.dmp
memory/924-46-0x0000000000D40000-0x0000000001D40000-memory.dmp
memory/924-47-0x0000000000D40000-0x0000000001D40000-memory.dmp
memory/924-48-0x0000000000D40000-0x0000000001D40000-memory.dmp
memory/924-49-0x0000000000D40000-0x0000000001D40000-memory.dmp
memory/924-50-0x0000000000D40000-0x0000000001D40000-memory.dmp
C:\ProgramData\remcos\logs.dat
| MD5 | f8bde8dff2004ebfd2018aeb6aca209c |
| SHA1 | 3bd33b798164235ab6a3b8e829771f2a2eeaa5e9 |
| SHA256 | ffa9acb58abcb28013b8c5cf61dd71de508158063b655568feb0c50fe73e0254 |
| SHA512 | cebbf9a84e486916f9c7d979534569895cea6c426448889daf10807cd023a0c60549d6b80f82115f611b0bcd188dae2803ce409fda38bafcb91b2e46e8673c7b |
memory/924-58-0x0000000000D40000-0x0000000001D40000-memory.dmp
memory/924-59-0x0000000000D40000-0x0000000001D40000-memory.dmp
memory/924-65-0x0000000000D40000-0x0000000001D40000-memory.dmp
memory/924-66-0x0000000000D40000-0x0000000001D40000-memory.dmp
memory/924-73-0x0000000000D40000-0x0000000001D40000-memory.dmp
memory/924-74-0x0000000000D40000-0x0000000001D40000-memory.dmp
memory/924-81-0x0000000000D40000-0x0000000001D40000-memory.dmp
memory/924-82-0x0000000000D40000-0x0000000001D40000-memory.dmp