Overview

overview

10

Static

static

10

daa6fc9ce4...18.dll

windows7-x64

10

daa6fc9ce4...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    daa6fc9ce47213d49ba91a8b78a80757_JaffaCakes118

  • Size

    331KB

  • Sample

    240911-swgwcsxhnn

  • MD5

    daa6fc9ce47213d49ba91a8b78a80757

  • SHA1

    f59089791f289f0d2ec3b5729ef46827f4fa6d41

  • SHA256

    87422011d60613bf2f591057dd05fea2b896d56c5781b1875f1728b471b9d549

  • SHA512

    9a716152086a13d1c2e6ad16d35304e9260cec4982b7220d5a6ed41694fbddfa87c050892604141e6e7c4016af0761781e308787d14aa9ff31a80d4d8b270157

  • SSDEEP

    6144:cCFNcE5fx1TYK4xkv/BugEm4QrxcTq670nCGQktzJwZkiZalKRDw9:9NcE5fT54xkv/B34Qi240SktzJbipG9

Score
10/10
modiloaderremcoshotdefense_evasiondiscoverypersistenceprivilege_escalationrattrojan

Malware Config

Extracted

Family

remcos

Version

2.7.1 Pro

Botnet

HOT

C2

boot.awsmppl.com:2266

coolta71.com:2266

coolta1.xzy:2266

coolta2.xzy:2266

coolget1.xzy:2266

coolcc1.xzy:2266
Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    dop.dt

  • keylog_flag

    false

  • keylog_folder

    coss

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    hotter-O8I6NR

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    wikipedia;solitaire;

Targets

    • Target

      daa6fc9ce47213d49ba91a8b78a80757_JaffaCakes118

    • Size

      331KB

    • MD5

      daa6fc9ce47213d49ba91a8b78a80757

    • SHA1

      f59089791f289f0d2ec3b5729ef46827f4fa6d41

    • SHA256

      87422011d60613bf2f591057dd05fea2b896d56c5781b1875f1728b471b9d549

    • SHA512

      9a716152086a13d1c2e6ad16d35304e9260cec4982b7220d5a6ed41694fbddfa87c050892604141e6e7c4016af0761781e308787d14aa9ff31a80d4d8b270157

    • SSDEEP

      6144:cCFNcE5fx1TYK4xkv/BugEm4QrxcTq670nCGQktzJwZkiZalKRDw9:9NcE5fT54xkv/B34Qi240SktzJbipG9

    Score
    10/10
    modiloaderdiscoverytrojanremcoshotdefense_evasionpersistenceprivilege_escalationrat

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • ModiLoader Second Stage

    • Abuse Elevation Control Mechanism: Bypass User Account Control

      UAC Bypass Attempt via SilentCleanup Task.

      defense_evasionprivilege_escalation

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks