Analysis
-
max time kernel
162s -
max time network
182s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-04-2024 01:14
Static task
static1
Behavioral task
behavioral1
Sample
67f61357cf2d027bb18929c72aae2e8427ed0ddb7c16e4265855b8d827d95518.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
67f61357cf2d027bb18929c72aae2e8427ed0ddb7c16e4265855b8d827d95518.exe
Resource
win10v2004-20240226-en
General
-
Target
67f61357cf2d027bb18929c72aae2e8427ed0ddb7c16e4265855b8d827d95518.exe
-
Size
1.6MB
-
MD5
488f8d9de535475e4a901c033199ea0c
-
SHA1
3bda45e062fdc55823d9ceb71d0575df1e6ffd9e
-
SHA256
67f61357cf2d027bb18929c72aae2e8427ed0ddb7c16e4265855b8d827d95518
-
SHA512
58c0bb1af9b495f4c20a518d158f35a96d3f51dbb026b7fc40572a212dd7f05221f11efa995ef10199d32f970a308ea25407b77d307eeed06bd91b897ddbc4a4
-
SSDEEP
49152:ay6imwGhfj4GBT2z95Zw/L+gwnzBnwyuPTh:azimw4f8iSuD+g
Malware Config
Extracted
remcos
RemoteHost
127.0.0.1:47212
officerem.duckdns.org:47212
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-I8N3XG
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1964-2-0x0000000002D80000-0x0000000003D80000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
Processes:
4095750.exepid process 672 4095750.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
67f61357cf2d027bb18929c72aae2e8427ed0ddb7c16e4265855b8d827d95518.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\Uajcyryw = "C:\\Users\\Public\\Uajcyryw.url" 67f61357cf2d027bb18929c72aae2e8427ed0ddb7c16e4265855b8d827d95518.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 4 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
67f61357cf2d027bb18929c72aae2e8427ed0ddb7c16e4265855b8d827d95518.exepid process 1964 67f61357cf2d027bb18929c72aae2e8427ed0ddb7c16e4265855b8d827d95518.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
67f61357cf2d027bb18929c72aae2e8427ed0ddb7c16e4265855b8d827d95518.exedescription pid process target process PID 1964 wrote to memory of 2464 1964 67f61357cf2d027bb18929c72aae2e8427ed0ddb7c16e4265855b8d827d95518.exe cmd.exe PID 1964 wrote to memory of 2464 1964 67f61357cf2d027bb18929c72aae2e8427ed0ddb7c16e4265855b8d827d95518.exe cmd.exe PID 1964 wrote to memory of 2464 1964 67f61357cf2d027bb18929c72aae2e8427ed0ddb7c16e4265855b8d827d95518.exe cmd.exe PID 1964 wrote to memory of 2464 1964 67f61357cf2d027bb18929c72aae2e8427ed0ddb7c16e4265855b8d827d95518.exe cmd.exe PID 1964 wrote to memory of 2488 1964 67f61357cf2d027bb18929c72aae2e8427ed0ddb7c16e4265855b8d827d95518.exe cmd.exe PID 1964 wrote to memory of 2488 1964 67f61357cf2d027bb18929c72aae2e8427ed0ddb7c16e4265855b8d827d95518.exe cmd.exe PID 1964 wrote to memory of 2488 1964 67f61357cf2d027bb18929c72aae2e8427ed0ddb7c16e4265855b8d827d95518.exe cmd.exe PID 1964 wrote to memory of 2488 1964 67f61357cf2d027bb18929c72aae2e8427ed0ddb7c16e4265855b8d827d95518.exe cmd.exe PID 1964 wrote to memory of 948 1964 67f61357cf2d027bb18929c72aae2e8427ed0ddb7c16e4265855b8d827d95518.exe cmd.exe PID 1964 wrote to memory of 948 1964 67f61357cf2d027bb18929c72aae2e8427ed0ddb7c16e4265855b8d827d95518.exe cmd.exe PID 1964 wrote to memory of 948 1964 67f61357cf2d027bb18929c72aae2e8427ed0ddb7c16e4265855b8d827d95518.exe cmd.exe PID 1964 wrote to memory of 948 1964 67f61357cf2d027bb18929c72aae2e8427ed0ddb7c16e4265855b8d827d95518.exe cmd.exe PID 1964 wrote to memory of 2792 1964 67f61357cf2d027bb18929c72aae2e8427ed0ddb7c16e4265855b8d827d95518.exe extrac32.exe PID 1964 wrote to memory of 2792 1964 67f61357cf2d027bb18929c72aae2e8427ed0ddb7c16e4265855b8d827d95518.exe extrac32.exe PID 1964 wrote to memory of 2792 1964 67f61357cf2d027bb18929c72aae2e8427ed0ddb7c16e4265855b8d827d95518.exe extrac32.exe PID 1964 wrote to memory of 2792 1964 67f61357cf2d027bb18929c72aae2e8427ed0ddb7c16e4265855b8d827d95518.exe extrac32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\67f61357cf2d027bb18929c72aae2e8427ed0ddb7c16e4265855b8d827d95518.exe"C:\Users\Admin\AppData\Local\Temp\67f61357cf2d027bb18929c72aae2e8427ed0ddb7c16e4265855b8d827d95518.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c mkdir "\\?\C:\Windows "2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c mkdir "\\?\C:\Windows \System32"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Windows \System32\4095750.exe"2⤵
-
C:\Windows \System32\4095750.exe"C:\Windows \System32\4095750.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\extrac32.exeC:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Admin\AppData\Local\Temp\67f61357cf2d027bb18929c72aae2e8427ed0ddb7c16e4265855b8d827d95518.exe C:\\Users\\Public\\Libraries\\Uajcyryw.PIF2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\remcos\logs.datFilesize
168B
MD5ee93ac8b164928823526b28b0adc8c8e
SHA145b9a99b2547177fd4f2b81072085fd299809d60
SHA2561665e110a6f5164f584a68a62016705a8de160d04e1d19e05f900df6eaf48d90
SHA512c6b8d4026ea8b13ce3a8fc709b57499dfb1c3049da1a13bd060421b5ccc1a0c5014a2d74485814a56f3403cc84d20cbdcf10f34f357142cec4967877e1da66fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\Local\Temp\TarFA2E.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
C:\Windows \System32\4095750.exeFilesize
128KB
MD5231ce1e1d7d98b44371ffff407d68b59
SHA125510d0f6353dbf0c9f72fc880de7585e34b28ff
SHA25630951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96
SHA512520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612
-
memory/948-69-0x0000000001F90000-0x0000000001F91000-memory.dmpFilesize
4KB
-
memory/948-63-0x0000000001F90000-0x0000000001F91000-memory.dmpFilesize
4KB
-
memory/1964-4-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1964-1-0x0000000002D80000-0x0000000003D80000-memory.dmpFilesize
16.0MB
-
memory/1964-5-0x0000000000400000-0x00000000005AF000-memory.dmpFilesize
1.7MB
-
memory/1964-79-0x0000000015A90000-0x0000000016A90000-memory.dmpFilesize
16.0MB
-
memory/1964-78-0x0000000015A90000-0x0000000016A90000-memory.dmpFilesize
16.0MB
-
memory/1964-109-0x0000000015A90000-0x0000000016A90000-memory.dmpFilesize
16.0MB
-
memory/1964-2-0x0000000002D80000-0x0000000003D80000-memory.dmpFilesize
16.0MB
-
memory/1964-65-0x0000000015A90000-0x0000000016A90000-memory.dmpFilesize
16.0MB
-
memory/1964-86-0x0000000015A90000-0x0000000016A90000-memory.dmpFilesize
16.0MB
-
memory/1964-0-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1964-89-0x0000000015A90000-0x0000000016A90000-memory.dmpFilesize
16.0MB
-
memory/1964-90-0x0000000015A90000-0x0000000016A90000-memory.dmpFilesize
16.0MB
-
memory/1964-96-0x0000000015A90000-0x0000000016A90000-memory.dmpFilesize
16.0MB
-
memory/1964-98-0x0000000015A90000-0x0000000016A90000-memory.dmpFilesize
16.0MB
-
memory/1964-97-0x0000000015A90000-0x0000000016A90000-memory.dmpFilesize
16.0MB
-
memory/1964-108-0x0000000015A90000-0x0000000016A90000-memory.dmpFilesize
16.0MB
-
memory/1964-71-0x0000000015A90000-0x0000000016A90000-memory.dmpFilesize
16.0MB