modiloader | 78d800daa2c85bbf244794523a10e382a440743a0586aa87d96cf114ea1ecbfe

General

Target

dcd79da0356caad135b3f7e9c1584cad_JaffaCakes118.exe
Size

605KB
MD5

dcd79da0356caad135b3f7e9c1584cad
SHA1

61f6800b9b8fab4cef123e560d0168d4bb2e004b
SHA256

78d800daa2c85bbf244794523a10e382a440743a0586aa87d96cf114ea1ecbfe
SHA512

d0ea2c79663a543be047112180155685614a014e7044d0a483de355a1194c4bfebef4c8890bff848baeae72b79d7250410936743a4f55d4316e38226b3cf6fb1
SSDEEP

12288:oWvREz3bo+DzjiYshnKiDnNzL/YFeJjDzE5vjwT:oWJj+DzjQ7BrjDzY

Score

10^/10

modiloader remcos backup discovery persistence rat trojan

Malware Config

Extracted

Family

remcos

Version

2.5.0 Pro

Botnet

Backup

C2

54.37.160.139:34049

185.244.30.78:34046

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
Windowsregistry
keylog_path
%AppData%
mouse_option
false
mutex
onedrive-P4DR4E
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
true
take_screenshot_time
5
take_screenshot_title
login;sigin;proforma;invoice;payment;pay;account;bank;paypal;bank;money;advance;login;credit;creditcard;https://www.lazada.com;https://www.flipkart.com;flipkart;lazada;https://www.rakuten.com;https://www.coupang.com;coupang;rakuten

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

ModiLoader First Stage 3 IoCs

resource	yara_rule
behavioral2/memory/624-1-0x0000000000400000-0x00000000004AA000-memory.dmp	modiloader_stage1
behavioral2/memory/624-3-0x0000000000400000-0x00000000004AA000-memory.dmp	modiloader_stage1
behavioral2/memory/624-28-0x0000000000400000-0x00000000004AA000-memory.dmp	modiloader_stage1

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Mxwl = "C:\\Users\\Public\\Mxwl\\Mxwl.hta"	dcd79da0356caad135b3f7e9c1584cad_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcd79da0356caad135b3f7e9c1584cad_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ieinstal.exe

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	21	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	23	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	25	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4776	ieinstal.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4776	ieinstal.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 4776	624	dcd79da0356caad135b3f7e9c1584cad_JaffaCakes118.exe	94
PID 624 wrote to memory of 4776	624	dcd79da0356caad135b3f7e9c1584cad_JaffaCakes118.exe	94
PID 624 wrote to memory of 4776	624	dcd79da0356caad135b3f7e9c1584cad_JaffaCakes118.exe	94
PID 624 wrote to memory of 4776	624	dcd79da0356caad135b3f7e9c1584cad_JaffaCakes118.exe	94
PID 624 wrote to memory of 4776	624	dcd79da0356caad135b3f7e9c1584cad_JaffaCakes118.exe	94
PID 624 wrote to memory of 4776	624	dcd79da0356caad135b3f7e9c1584cad_JaffaCakes118.exe	94
PID 624 wrote to memory of 4776	624	dcd79da0356caad135b3f7e9c1584cad_JaffaCakes118.exe	94
PID 624 wrote to memory of 4776	624	dcd79da0356caad135b3f7e9c1584cad_JaffaCakes118.exe	94
PID 624 wrote to memory of 4776	624	dcd79da0356caad135b3f7e9c1584cad_JaffaCakes118.exe	94
PID 624 wrote to memory of 4776	624	dcd79da0356caad135b3f7e9c1584cad_JaffaCakes118.exe	94
PID 624 wrote to memory of 4776	624	dcd79da0356caad135b3f7e9c1584cad_JaffaCakes118.exe	94
PID 624 wrote to memory of 4776	624	dcd79da0356caad135b3f7e9c1584cad_JaffaCakes118.exe	94
PID 624 wrote to memory of 4776	624	dcd79da0356caad135b3f7e9c1584cad_JaffaCakes118.exe	94
PID 624 wrote to memory of 4776	624	dcd79da0356caad135b3f7e9c1584cad_JaffaCakes118.exe	94
PID 624 wrote to memory of 4776	624	dcd79da0356caad135b3f7e9c1584cad_JaffaCakes118.exe	94
PID 624 wrote to memory of 4776	624	dcd79da0356caad135b3f7e9c1584cad_JaffaCakes118.exe	94
PID 624 wrote to memory of 4776	624	dcd79da0356caad135b3f7e9c1584cad_JaffaCakes118.exe	94

C:\Users\Admin\AppData\Local\Temp\dcd79da0356caad135b3f7e9c1584cad_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dcd79da0356caad135b3f7e9c1584cad_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:624
- C:\Program Files (x86)\internet explorer\ieinstal.exe
  "C:\Program Files (x86)\internet explorer\ieinstal.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:4776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Windowsregistry\logs.dat

Filesize
74B

MD5
20b502f43c2cf857808b3cb385a0aa6b

SHA1
815bd04d7457b9fe25226112118ad74f18c919c5

SHA256
36b09536d7899c371ff47b0a01c1c0049e942178fb1973930972664fb867f968

SHA512
de20f576b76fb9aa40edf254fea9fccc3f778b256a560bbcf5244794901cb6de8426108ad7b01131a8366f8205149077b69ea0621a70b46cdac037b9605b2354

Download Submit
C:\Users\Public\Mxwl\Mxwl

Filesize
471KB

MD5
1399263fdcd83b9c865bc5c0aeda75bb

SHA1
6137e46e83453b888cb1288407fffaceacdf41fa

SHA256
92b62e57e4e2cf4d09f901fef1e4b52fef4daa9b5aa56733cf994e48f2641864

SHA512
d84b488c0a617cb1e33e4c298c6992ec9f96a3cdeb33973a9fd242f2e4f1ab2e33f43f91c6cbdb75674e51bfee8c6e71fc0221604c74f0dca1d62ca350beffe0

Download Submit
memory/624-19-0x0000000010530000-0x0000000010553000-memory.dmp

Filesize
140KB

Download
memory/624-2-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/624-1-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/624-3-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/624-12-0x0000000010530000-0x0000000010553000-memory.dmp

Filesize
140KB

Download
memory/624-28-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/624-0-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4776-21-0x00000000010C0000-0x00000000010C1000-memory.dmp

Filesize
4KB

Download
memory/4776-22-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4776-23-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4776-27-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4776-15-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

Filesize
4KB

Download
memory/4776-29-0x0000000010530000-0x0000000010553000-memory.dmp

Filesize
140KB

Download
memory/4776-31-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4776-13-0x0000000000B80000-0x0000000000B81000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads