General

  • Target

    The-MALWARE-Repo

  • Size

    298KB

  • Sample

    240820-1d3zwaybjj

  • MD5

    8bfba286e034c4b29e00716800c4fa58

  • SHA1

    c779014fda4989d55405df16b3232147a1fe501f

  • SHA256

    85e58fbd1bdcf92d7f9ce1acdf26054b79a26e55d4f2ee2a5e1f8f93c0d739fc

  • SHA512

    4fffc1efee8c78de7f1284a64d6f822b2207d9515020bda01d58723bb37a9e34ac53ef629157b025f8192803f1487adaeb62a8072ca16f7251ad548b961969d2

  • SSDEEP

    6144:QnoYS3uokeOvHS1d1+sNs8wbiWQ99PvZJT3CqbMrhryf65NRPaCieMjAkvCJv1Vc:GoYS3uokeOvHS1d1+sNs8wbiWQ99PvZT

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Host

C2

nickman12-46565.portmap.io:46565

nickman12-46565.portmap.io:1735

Attributes
  • audio_folder

    audio

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    5

  • copy_file

    Userdata.exe

  • copy_folder

    Userdata

  • delete_file

    true

  • hide_file

    true

  • hide_keylog_file

    true

  • install_flag

    true

  • install_path

    %WinDir%\System32

  • keylog_crypt

    true

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %WinDir%\System32

  • mouse_option

    false

  • mutex

    remcos_vcexssuhap

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screens

  • screenshot_path

    %AppData%

  • screenshot_time

    1

  • startup_value

    remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Extracted

Family

modiloader

C2

https://drive.google.com/u/0/uc?id=1TcSctGVBajYMA7CFDc158wpvqkpxmkhJ&export=download

Targets

    • Target

      The-MALWARE-Repo

    • Size

      298KB

    • MD5

      8bfba286e034c4b29e00716800c4fa58

    • SHA1

      c779014fda4989d55405df16b3232147a1fe501f

    • SHA256

      85e58fbd1bdcf92d7f9ce1acdf26054b79a26e55d4f2ee2a5e1f8f93c0d739fc

    • SHA512

      4fffc1efee8c78de7f1284a64d6f822b2207d9515020bda01d58723bb37a9e34ac53ef629157b025f8192803f1487adaeb62a8072ca16f7251ad548b961969d2

    • SSDEEP

      6144:QnoYS3uokeOvHS1d1+sNs8wbiWQ99PvZJT3CqbMrhryf65NRPaCieMjAkvCJv1Vc:GoYS3uokeOvHS1d1+sNs8wbiWQ99PvZT

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • Modifies WinLogon for persistence

    • Modifies Windows Defender Real-time Protection settings

    • Modifies visiblity of hidden/system files in Explorer

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • UAC bypass

    • Windows security bypass

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • ModiLoader First Stage

    • Remote Service Session Hijacking: RDP Hijacking

      Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.

    • Blocks application from running via registry modification

      Adds application to list of disallowed applications.

    • Modifies Windows Firewall

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • Stops running service(s)

    • Executes dropped EXE

    • Modifies file permissions

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Password Policy Discovery

      Attempt to access detailed information about the password policy used within an enterprise network.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops file in System32 directory

    • Hide Artifacts: Hidden Users

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks