MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 98a4d17d6dee54f9242c704af627da853d978d6d37738f875d08ea0e7eaca373. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 16


Intelligence 16 IOCs YARA 13 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 98a4d17d6dee54f9242c704af627da853d978d6d37738f875d08ea0e7eaca373
SHA3-384 hash: 984acd3030fadb5d9242a56d0e61b8c4ee041a4cfd608c04ed10c22084874c611d36c6407d1a608547be738f954b9afd
SHA1 hash: 54a3eefb9126ae9605fae7397cdb6625fd0020a8
MD5 hash: 6b6a4031a7c6cbe5d6a73729750f01f1
humanhash: sad-romeo-apart-princess
File name:ORDER90112.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'254'400 bytes
First seen:2023-08-08 09:15:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a4dea6841158221e1f9d51cae1534166 (2 x ModiLoader, 1 x RemcosRAT)
ssdeep 24576:O+wrBX18XhVRGTbabra2OYSYf9PhHt8AE:OrnHKKD
Threatray 2'415 similar samples on MalwareBazaar
TLSH T1CD45AD32E6524833E2B6057C4F3B1FF45C2FBE73592859456AEC78B96F2B2402839167
TrID 53.4% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
16.8% (.SCR) Windows screen saver (13097/50/3)
13.5% (.EXE) Win64 Executable (generic) (10523/12/4)
5.7% (.EXE) Win32 Executable (generic) (4505/5/1)
2.6% (.EXE) Win16/32 Executable Delphi generic (2072/23)
File icon (PE):PE icon
dhash icon 2321270707090921 (2 x ModiLoader, 1 x RemcosRAT)
Reporter abuse_ch
Tags:exe RAT RemcosRAT


Avatar
abuse_ch
RemcosRAT C2:
178.32.90.242:2550

Intelligence

File Origin
# of uploads :
1
# of downloads :
333
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
remcos
Create hunting rule
ID:
1
File name:
ORDER90112.exe
Verdict:
Malicious activity
Analysis date:
2023-08-08 09:17:03 UTC
Tags:
dbatloader keylogger remcos
Link:
https://app.any.run/tasks/0491122e-400b-4080-abda-91ece65cdb90

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
ModiLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/441279/
Detection(s):
SecuriteInfo.com.Generic-EXE.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
DNS request
Sending a custom TCP request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
control keylogger lolbin masquerade obfuscated
Link:
https://www.filescan.io/uploads/64d207d33a7f18fa3455a557/reports/920ce515-7cf6-46d1-b66d-ba08bd794623/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/98a4d17d6dee54f9242c704af627da853d978d6d37738f875d08ea0e7eaca373
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Dbatloader
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/365ec398-f1af-4465-9c6d-ae70243c4432
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1287593
Signature
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
DLL side loading technique detected
Drops executables to the windows directory (C:\Windows) and starts them
Drops PE files with a suspicious file extension
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Installs a global keyboard hook
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sample uses process hollowing technique
Sigma detected: Remcos
Snort IDS alert for network traffic
Suspicious powershell command line found
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Writes to foreign memory regions
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1287593 Sample: ORDER90112.exe Startdate: 08/08/2023 Architecture: WINDOWS Score: 100 84 Snort IDS alert for network traffic 2->84 86 Found malware configuration 2->86 88 Malicious sample detected (through community Yara rule) 2->88 90 6 other signatures 2->90 10 ORDER90112.exe 1 8 2->10         started        15 Hulmbaul.PIF 2->15         started        17 Hulmbaul.PIF 2->17         started        process3 dnsIp4 66 web.fe.1drv.com 10->66 68 pvasiq.dm.files.1drv.com 10->68 74 2 other IPs or domains 10->74 56 C:\Users\Public\Libraries\netutils.dll, PE32+ 10->56 dropped 58 C:\Users\Public\Libraries\luabmluH.bat, PE32 10->58 dropped 60 C:\Users\Public\Libraries\easinvoker.exe, PE32+ 10->60 dropped 62 C:\Users\Public\Libraries\Hulmbaul.PIF, PE32 10->62 dropped 108 Drops PE files with a suspicious file extension 10->108 110 Writes to foreign memory regions 10->110 112 Allocates memory in foreign processes 10->112 19 cmd.exe 3 10->19         started        22 luabmluH.bat 3 2 10->22         started        70 web.fe.1drv.com 15->70 76 3 other IPs or domains 15->76 114 Multi AV Scanner detection for dropped file 15->114 116 Sample uses process hollowing technique 15->116 118 Injects a PE file into a foreign processes 15->118 25 luabmluH.bat 15->25         started        72 web.fe.1drv.com 17->72 78 3 other IPs or domains 17->78 27 luabmluH.bat 17->27         started        file5 signatures6 process7 dnsIp8 92 Uses ping.exe to sleep 19->92 94 Drops executables to the windows directory (C:\Windows) and starts them 19->94 96 Uses ping.exe to check the status of other devices and networks 19->96 29 easinvoker.exe 19->29         started        31 PING.EXE 1 19->31         started        34 xcopy.exe 2 19->34         started        39 6 other processes 19->39 64 www.rainbow-industrie.com 178.32.90.242, 2550, 49700 OVHFR France 22->64 98 Detected unpacking (changes PE section rights) 22->98 100 Detected unpacking (overwrites its own PE header) 22->100 102 Installs a global keyboard hook 22->102 37 WerFault.exe 22->37         started        signatures9 process10 dnsIp11 41 cmd.exe 1 29->41         started        82 127.0.0.1 unknown unknown 31->82 52 C:\Windows \System32\easinvoker.exe, PE32+ 34->52 dropped 54 C:\Windows \System32\netutils.dll, PE32+ 39->54 dropped file12 process13 signatures14 104 Suspicious powershell command line found 41->104 106 Adds a directory exclusion to Windows Defender 41->106 44 powershell.exe 21 41->44         started        48 conhost.exe 41->48         started        process15 dnsIp16 80 192.168.2.1 unknown unknown 44->80 120 DLL side loading technique detected 44->120 50 conhost.exe 44->50         started        signatures17 process18
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/98a4d17d6dee54f9242c704af627da853d978d6d37738f875d08ea0e7eaca373/
Threat name:
Win32.Downloader.Ponik
Create hunting rule
Status:
Malicious
First seen:
2023-08-08 09:16:06 UTC
File Type:
PE (Exe)
Extracted files:
48
AV detection:
20 of 24 (83.33%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tcsnc7ln5zkpsjbmobfpmj62qu6zpdlng5zy7b25bdva47vmunzq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
0f611b87697a816d5b37f745fa94c89315327ba3458c190fe41efd891ccd5196
RemcosRAT
4fa02ec602055dfbdb1d639b3d265d8f7b20d6cd328fdb62dd77b7a1aad5829a
RemcosRAT
6333f3de90012f2acd3436fbd0bc2672a989238ccd7ea97a948c2f07f6397a9e
RemcosRAT
63ef4597dd8f8958ab0c9c5f486e98a1bc7de071927925f413a184a48178d017
RemcosRAT
9d8282d54901d4e795f0469a5191242b2e7b3b0c51f810f71c739bfff52de8d5
RemcosRAT
af4302878827cd62e91d7f42d963b213f4dbb220b28148f86f63a799666b1931
RemcosRAT
b5ca34b966549dfee1a824ab645c66b17217aadda4ccea96731b8cb0cfb03a27
RemcosRAT
f56f255d748be9370700d75eab9e32735fe802f885c81f88d0c8b91f022c2673
RemcosRAT
f7ecefbcf3572d8b3f40ab5c23b1a62366bb8d49b603b3d54e4b46bcd6779eee
RemcosRAT
+ 2'405 additional samples on MalwareBazaar
Result
Malware family:
modiloader
Create hunting rule
Score:
  10/10
Tags:
family:modiloader persistence trojan
Link:
https://tria.ge/reports/230808-k8fvtsdb7y/
Behaviour
Runs ping.exe
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Adds Run key to start application
Executes dropped EXE
Loads dropped DLL
ModiLoader Second Stage
ModiLoader, DBatLoader
Suspicious use of NtCreateProcessOtherParentProcess
Unpacked files
SH256 hash:
bb4ecb0c2a04e7a5ab8ef61745a8ba84417407aa87605f6524e07fbf3389f184
MD5 hash:
f48b7df9660819bdec075b5ae250fae6
SHA1 hash:
5504f5ebc96525a82e24158e9a1d531b377efe5e
Detections:
win_dbatloader_g1
Create hunting rule
Link:
https://www.unpac.me/results/b70d7b18-2164-4ef8-b4cf-d6bec955cac4/
Parent samples :
cf88620c3c0e2ff7cf3f6b1676ca6cff10bb65abaeb95b73dc0ccc378a7023e4
98a4d17d6dee54f9242c704af627da853d978d6d37738f875d08ea0e7eaca373
2f1ca9ea9c439cddf83672896fe9810ce3d3aa2218f3718f121e90a19e3a25e6
SH256 hash:
7bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301
MD5 hash:
c116d3604ceafe7057d77ff27552c215
SHA1 hash:
452b14432fb5758b46f2897aeccd89f7c82a727d
Link:
https://www.unpac.me/results/b70d7b18-2164-4ef8-b4cf-d6bec955cac4/
SH256 hash:
98a4d17d6dee54f9242c704af627da853d978d6d37738f875d08ea0e7eaca373
MD5 hash:
6b6a4031a7c6cbe5d6a73729750f01f1
SHA1 hash:
54a3eefb9126ae9605fae7397cdb6625fd0020a8
Detections:
DbatLoaderStage1
Create hunting rule
Link:
https://www.unpac.me/results/b70d7b18-2164-4ef8-b4cf-d6bec955cac4/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/98a4d17d6dee/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Remcos
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/98a4d17d6dee54f9242c704af627da853d978d6d37738f875d08ea0e7eaca373

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:BobSoftMiniDelphiBoBBobSoft
Create hunting rule
Author:malware-lu
Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:CMD_Ping_Localhost
Create hunting rule
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:MALWARE_Win_ModiLoader
Create hunting rule
Author:ditekSHen
Description:Detects ModiLoader
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Typical_Malware_String_Transforms
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects typical strings in a reversed or otherwise modified form
Reference:Internal Research
Rule name:Typical_Malware_String_Transforms_RID3473
Create hunting rule
Author:Florian Roth
Description:Detects typical strings in a reversed or otherwise modified form
Reference:Internal Research
Rule name:without_attachments
Create hunting rule
Author:Antonio Sanchez <asanchez@hispasec.com>
Description:Rule to detect the no presence of any attachment
Reference:http://laboratorio.blogs.hispasec.com/
Rule name:without_urls
Create hunting rule
Author:Antonio Sanchez <asanchez@hispasec.com>
Description:Rule to detect the no presence of any url
Reference:http://laboratorio.blogs.hispasec.com/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/441279/

Comments