modiloader | 512a5c196625c71b99037ea18a34b29e620ecd72e81073cc3143396bf43b5d61

Analysis

max time kernel
139s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
01/04/2025, 10:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

remcos.exe
Size

1.6MB
MD5

d8a9c29e11551ed7cd75a7647b60f390
SHA1

969dbab818aea458ff5c4537c017ce04a5e568d0
SHA256

512a5c196625c71b99037ea18a34b29e620ecd72e81073cc3143396bf43b5d61
SHA512

0023ff145b5fc82792c689510b96a81598754d13d170a3948c5fc7fd485ac5a31dceb3e729674abc51cc8a6f71e986d1158ce3e69b154036debb5d39a7164261
SSDEEP

24576:OkCIwKMTJndSh1pBOzgqDx/u09mxzy8DfrKwUaYJ4PGd77iSI2grsZnbdWy8stfG:OkCzgUHDYuhJ4Ox7iS3grsBbdiw

Score

10^/10

modiloader discovery persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 61 IoCs

resource	yara_rule
behavioral1/memory/4068-2-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-5-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-13-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-27-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-53-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-52-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-45-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-43-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-41-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-40-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-39-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-36-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-31-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-61-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-30-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-29-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-57-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-55-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-54-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-26-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-51-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-25-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-50-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-49-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-46-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-24-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-23-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-44-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-42-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-22-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-21-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-20-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-19-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-38-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-37-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-18-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-35-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-34-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-17-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-33-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-32-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-16-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-15-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-14-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-28-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-12-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-11-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-10-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-9-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-8-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-7-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-4-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-6-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-65-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-64-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-63-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-62-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-60-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-59-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-58-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2
behavioral1/memory/4068-56-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\International\Geo\Nation	remcos.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\International\Geo\Nation	rundll32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\International\Geo\Nation	Jtmicriz.PIF
Key value queried	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 9 IoCs

pid	Process
5788	alpha.pif
3524	alpha.pif
2948	remcos.exe
5280	remcos.exe
2600	remcos.exe
4252	Jtmicriz.PIF
4716	remcos.exe
4696	remcos.exe
5248	remcos.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\chrome\\remcos.exe\""	remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\chrome\\remcos.exe\""	remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\chrome\\remcos.exe\""	Jtmicriz.PIF
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\chrome\\remcos.exe\""	Jtmicriz.PIF

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 6 IoCs

pid	pid_target	Process	procid_target
2752	5280	WerFault.exe	119
5180	2600	WerFault.exe	123
5252	2948	WerFault.exe	117
5264	4716	WerFault.exe	147
4592	4696	WerFault.exe	148
5992	5248	WerFault.exe	152

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	alpha.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jtmicriz.PIF
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	alpha.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1432	PING.EXE

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings	Jtmicriz.PIF
Key created	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings	remcos.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1432	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5824	schtasks.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 4368	4068	remcos.exe	100
PID 4068 wrote to memory of 4368	4068	remcos.exe	100
PID 4068 wrote to memory of 4368	4068	remcos.exe	100
PID 4068 wrote to memory of 4960	4068	remcos.exe	101
PID 4068 wrote to memory of 4960	4068	remcos.exe	101
PID 4068 wrote to memory of 4960	4068	remcos.exe	101
PID 4368 wrote to memory of 6056	4368	cmd.exe	104
PID 4368 wrote to memory of 6056	4368	cmd.exe	104
PID 4368 wrote to memory of 6056	4368	cmd.exe	104
PID 4960 wrote to memory of 1432	4960	cmd.exe	105
PID 4960 wrote to memory of 1432	4960	cmd.exe	105
PID 4960 wrote to memory of 1432	4960	cmd.exe	105
PID 4368 wrote to memory of 5788	4368	cmd.exe	106
PID 4368 wrote to memory of 5788	4368	cmd.exe	106
PID 4368 wrote to memory of 5788	4368	cmd.exe	106
PID 4368 wrote to memory of 3524	4368	cmd.exe	107
PID 4368 wrote to memory of 3524	4368	cmd.exe	107
PID 4368 wrote to memory of 3524	4368	cmd.exe	107
PID 4068 wrote to memory of 4988	4068	remcos.exe	108
PID 4068 wrote to memory of 4988	4068	remcos.exe	108
PID 4068 wrote to memory of 4988	4068	remcos.exe	108
PID 4988 wrote to memory of 5824	4988	cmd.exe	111
PID 4988 wrote to memory of 5824	4988	cmd.exe	111
PID 4988 wrote to memory of 5824	4988	cmd.exe	111
PID 4068 wrote to memory of 4936	4068	remcos.exe	118
PID 4068 wrote to memory of 4936	4068	remcos.exe	118
PID 4068 wrote to memory of 4936	4068	remcos.exe	118
PID 4932 wrote to memory of 2948	4932	cmd.exe	117
PID 4932 wrote to memory of 2948	4932	cmd.exe	117
PID 4932 wrote to memory of 2948	4932	cmd.exe	117
PID 3764 wrote to memory of 5280	3764	cmd.exe	119
PID 3764 wrote to memory of 5280	3764	cmd.exe	119
PID 3764 wrote to memory of 5280	3764	cmd.exe	119
PID 4936 wrote to memory of 5708	4936	WScript.exe	121
PID 4936 wrote to memory of 5708	4936	WScript.exe	121
PID 4936 wrote to memory of 5708	4936	WScript.exe	121
PID 5708 wrote to memory of 2600	5708	cmd.exe	123
PID 5708 wrote to memory of 2600	5708	cmd.exe	123
PID 5708 wrote to memory of 2600	5708	cmd.exe	123
PID 2380 wrote to memory of 4252	2380	rundll32.exe	141
PID 2380 wrote to memory of 4252	2380	rundll32.exe	141
PID 2380 wrote to memory of 4252	2380	rundll32.exe	141
PID 1076 wrote to memory of 4716	1076	cmd.exe	147
PID 1076 wrote to memory of 4716	1076	cmd.exe	147
PID 1076 wrote to memory of 4716	1076	cmd.exe	147
PID 5020 wrote to memory of 4696	5020	cmd.exe	148
PID 5020 wrote to memory of 4696	5020	cmd.exe	148
PID 5020 wrote to memory of 4696	5020	cmd.exe	148
PID 4252 wrote to memory of 5772	4252	Jtmicriz.PIF	149
PID 4252 wrote to memory of 5772	4252	Jtmicriz.PIF	149
PID 4252 wrote to memory of 5772	4252	Jtmicriz.PIF	149
PID 5772 wrote to memory of 4360	5772	WScript.exe	150
PID 5772 wrote to memory of 4360	5772	WScript.exe	150
PID 5772 wrote to memory of 4360	5772	WScript.exe	150
PID 4360 wrote to memory of 5248	4360	cmd.exe	152
PID 4360 wrote to memory of 5248	4360	cmd.exe	152
PID 4360 wrote to memory of 5248	4360	cmd.exe	152

C:\Users\Admin\AppData\Local\Temp\remcos.exe
"C:\Users\Admin\AppData\Local\Temp\remcos.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\\ProgramData\\2707.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4368
- - C:\Windows\SysWOW64\esentutl.exe
    C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o
    3⤵
    PID:6056
- - C:\Users\Public\alpha.pif
    C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows "
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5788
- - C:\Users\Public\alpha.pif
    C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3524
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\\ProgramData\\32703.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 10
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1432
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\\ProgramData\\546.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Jtmicriz" /tr C:\\ProgramData\\Jtmicriz.url"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5824
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4936
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\chrome\remcos.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5708
  - - C:\ProgramData\chrome\remcos.exe
      C:\ProgramData\chrome\remcos.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2600
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 1112
        5⤵
        Program crash
        
        PID:5180

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\ProgramData\chrome\remcos.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3764
- C:\ProgramData\chrome\remcos.exe
  C:\ProgramData\chrome\remcos.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5280
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5280 -s 1152
    3⤵
    - Program crash
    PID:2752

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\ProgramData\chrome\remcos.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4932
- C:\ProgramData\chrome\remcos.exe
  C:\ProgramData\chrome\remcos.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2948
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 1288
    3⤵
    - Program crash
    PID:5252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5280 -ip 5280
1⤵
PID:2872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2948 -ip 2948
1⤵
PID:1308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2600 -ip 2600
1⤵
PID:5440

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Windows\System32\ieframe.dll",OpenURL C:\\ProgramData\\Jtmicriz.url
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Users\Admin\Links\Jtmicriz.PIF
  "C:\Users\Admin\Links\Jtmicriz.PIF"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4252
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5772
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\chrome\remcos.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4360
    - - C:\ProgramData\chrome\remcos.exe
        
        C:\ProgramData\chrome\remcos.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5248
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5248 -s 1112
        6⤵
        Program crash
        
        PID:5992

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\ProgramData\chrome\remcos.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5020
- C:\ProgramData\chrome\remcos.exe
  C:\ProgramData\chrome\remcos.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4696
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 1148
    3⤵
    - Program crash
    PID:4592

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\ProgramData\chrome\remcos.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1076
- C:\ProgramData\chrome\remcos.exe
  C:\ProgramData\chrome\remcos.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4716
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 1152
    3⤵
    - Program crash
    PID:5264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4716 -ip 4716
1⤵
PID:2872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4696 -ip 4696
1⤵
PID:3636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 5248 -ip 5248
1⤵
PID:4888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\2707.cmd

Filesize
19KB

MD5
1df650cca01129127d30063634ab5c03

SHA1
bc7172dec0b12b05f2247bd5e17751eb33474d4e

SHA256
edd4094e7a82a6ff8be65d6b075e9513bd15a6b74f8032b5c10ce18f7191fa60

SHA512
0bddf9ecaaedb0c30103a1fbfb644d6d4f7608bd596403307ed89b2390568c3a29e2cf55d10e2eadbfc407ede52eaf9a4f2321ba5f37e358a1039f73c7688fbd

Download Submit
C:\ProgramData\32703.cmd

Filesize
2KB

MD5
9a020804eba1ffac2928d7c795144bbf

SHA1
61fdc4135afdc99e106912aeafeac9c8a967becc

SHA256
a86c6c7a2bf9e12c45275a5e7ebebd5e6d2ba302fe0a12600b7c9fdf283d9e63

SHA512
42f6d754f1bdbeb6e4cc7aeb57ff4c4d126944f950d260a0839911e576ad16002c16122f81c1d39fa529432dca0a48c9acfbb18804ca9044425c8e424a5518be

Download Submit
C:\ProgramData\546.cmd

Filesize
83B

MD5
487a20730626d1ae8bf3adda4c5b97d7

SHA1
a2331cf871660a29da89123de61ecfc617b0557e

SHA256
3a4a5f94de0f0dbb9014555d6be59513bedad16dbb2ae2baa264ae14240ab865

SHA512
5074a359386d292782f5cd7152559ef4f4454c893efc1b45016d1880fb48fec595553a031b31e868ece7896df9a1a038d5e1c139226f195d7917a8c43207430d

Download Submit
C:\ProgramData\Jtmicriz.url

Filesize
98B

MD5
96385610ecdc1f907e7c3c0e5eece431

SHA1
4f66ef9e20c4e81acc1361c0862d55d4522cfabe

SHA256
8d12aa3049c8cdab00be8acb7ca41f08ce19fd86bf5eeedb87b8bc1e2322cd0b

SHA512
5862c31a06bc519fbae0a3659e5f8ce9397fe086c37221c9ec9e269b0acff47ba1d91fa101ad143f22d31c355e3a51a841f3c23e13150c3fc9b781f9a1ff8f48

Download Submit
C:\ProgramData\chrome\remcos.exe

Filesize
1.6MB

MD5
d8a9c29e11551ed7cd75a7647b60f390

SHA1
969dbab818aea458ff5c4537c017ce04a5e568d0

SHA256
512a5c196625c71b99037ea18a34b29e620ecd72e81073cc3143396bf43b5d61

SHA512
0023ff145b5fc82792c689510b96a81598754d13d170a3948c5fc7fd485ac5a31dceb3e729674abc51cc8a6f71e986d1158ce3e69b154036debb5d39a7164261

Download Submit
C:\Users\Admin\AppData\Local\Temp\install.vbs

Filesize
386B

MD5
36c0472fa5b6e3249bf55ea66ec0cbbc

SHA1
568644a942fe7837a173971fc95ab09e2af33b34

SHA256
1c681529ceff5af8e35a75c3b4390dd51eafe48873e7c13bb1524aa304ac0781

SHA512
bba4f04a01a89469d978e3a1a32090daf835f3abd27bb3d4127aaa2ad42017d8174a9f2c1f9593ad3097212f5a9e055d3c8b721fb136e797bb0c15eea18fee17

Download Submit
C:\Users\Public\alpha.pif

Filesize
231KB

MD5
d0fce3afa6aa1d58ce9fa336cc2b675b

SHA1
4048488de6ba4bfef9edf103755519f1f762668f

SHA256
4d89fc34d5f0f9babd022271c585a9477bf41e834e46b991deaa0530fdb25e22

SHA512
80e127ef81752cd50f9ea2d662dc4d3bf8db8d29680e75fa5fc406ca22cafa5c4d89ef2eac65b486413d3cdd57a2c12a1cb75f65d1e312a717d262265736d1c2

Download Submit
memory/4068-44-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-20-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-13-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-27-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-53-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-52-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-45-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-43-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-41-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-40-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-39-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-36-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-31-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-61-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-30-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-29-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-57-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-55-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-54-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-26-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-51-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-25-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-50-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-49-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-46-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-24-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-48-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/4068-47-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/4068-23-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-2-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-42-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-22-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-5-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-19-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-21-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-38-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-37-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-18-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-35-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-34-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-17-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-33-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-32-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-16-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-15-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-14-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-28-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-12-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-11-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-10-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-9-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-8-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-7-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-4-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-6-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-65-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-64-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-63-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-62-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-60-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-59-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-1-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-0-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/4068-58-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/4068-56-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads