Analysis
- max time kernel
146s - max time network
150s - platform
windows10_x64 - resource
win10v200722 - submitted
05/10/2020, 11:46
Static task
static1
Behavioral task
behavioral1
Sample
Vyvfiah_Signed_.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Vyvfiah_Signed_.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
- Target Vyvfiah_Signed_.exe
- Size 960KB
- Sample201005-wm2ppfzaze
- SHA256 4b183077cbfa209aab597f0cfe66178add15a0d590ba3abdf170ae708617bfef
- MD5 d441c317c91b2d02fd7118d9395391de
- SHA1 81802cdc26cd23f07c87369bceeef346fc6764d5
- SHA512 f07b53080edc6194067fbf5ffe9d4f8ed41609677c795ef1d3ecd04e1904b31d722d331ba037f29b5b79c1655aa41730474157c3050da496ffb3df98a831887b
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.mansiobok3.info/m3px/
Decoy
-
storehemp.review
-
trackingyee.com
-
location-climatiseur-france.com
-
objectivecitizen.com
-
prestigepropertiesintlllc.net
-
michellemillerart.com
-
sortfinances.com
-
szcmjxsb.com
-
lookingblackward.info
-
mairsure-data.com
-
womanlybuzz.com
-
wecanmovies.com
-
melaniewhitmarsh.com
-
eyebrightbeer.com
-
iehdm.com
-
0h7fiveother.loan
-
floordynasty.com
-
metodoabruzzo.com
-
rannveigsvendby.com
-
all-things-trail.com
-
portsmouthlionsnh.com
-
lsss777.com
-
headhonchookc.com
-
vipforex.biz
-
offertruck11.com
-
konisdesign.com
-
wpexcellent.com
-
snowboards.international
-
wycomm.com
-
cityafrica.com
-
ptcworld.info
-
transformationzoneblog.com
-
amxpj0005.com
-
tmoec.info
-
melbourneculture.tours
-
ironridgesporthorses.com
-
xhtd219.com
-
orancitysoft.com
-
masterrecovery.net
-
crenegant.com
-
www346234.com
-
thedraftmedic.com
-
jy0411.net
-
chetiezhi.com
-
sarvicenow.com
-
945uaf.info
-
cache.ltd
-
gaziantepulucanlarasm.com
-
jewelryheroes.com
-
okabeiot.com
-
tinyheroes3d.com
-
kikkisuit.com
-
immobilien-grevenbroich.com
-
rhino-repair.com
-
puppypullover.com
-
sarap-ala-eh.com
-
goddessluna.com
-
yattatokyo.com
-
bricres.com
-
jianghundk.com
-
premiumleben.com
-
madamefiepatisserie.com
-
physiofitjulie.com
-
heldsysexch.com
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- Formbook Payload 3 IoCs
resource yara_rule behavioral2/memory/3816-1-0x0000000010410000-0x000000001043D000-memory.dmp formbook behavioral2/memory/3928-3-0x0000000000000000-mapping.dmp formbook behavioral2/memory/1544-4-0x0000000000000000-mapping.dmp formbook - ModiLoader Second Stage 1 IoCs
resource yara_rule behavioral2/memory/3816-0-0x00000000046D0000-0x0000000004730000-memory.dmp modiloader_stage2 - Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\User\S-1-5-21-1400429095-533421673-2598934218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\FRAL_RV = "C:\\Program Files (x86)\\internet explorer\\ieinstal.exe" wscript.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \Registry\User\S-1-5-21-1400429095-533421673-2598934218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run wscript.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3928 set thread context of 2996 3928 ieinstal.exe 56 PID 1544 set thread context of 2996 1544 wscript.exe 56 -
description ioc Process Key created \Registry\User\S-1-5-21-1400429095-533421673-2598934218-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 wscript.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b06010505070308060a2b0601040182370a030406082b0601050507030606082b0601050507030106082b0601050507030706082b0601050507030206082b0601050507030406082b0601050507030353000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Vyvfiah_Signed_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Vyvfiah_Signed_.exe - Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 3928 ieinstal.exe 3928 ieinstal.exe 3928 ieinstal.exe 3928 ieinstal.exe 1544 wscript.exe 1544 wscript.exe 1544 wscript.exe 1544 wscript.exe 1544 wscript.exe 1544 wscript.exe 1544 wscript.exe 1544 wscript.exe 1544 wscript.exe 1544 wscript.exe 1544 wscript.exe 1544 wscript.exe 1544 wscript.exe 1544 wscript.exe 1544 wscript.exe 1544 wscript.exe 1544 wscript.exe 1544 wscript.exe 1544 wscript.exe 1544 wscript.exe 1544 wscript.exe 1544 wscript.exe 1544 wscript.exe 1544 wscript.exe 1544 wscript.exe 1544 wscript.exe 1544 wscript.exe 1544 wscript.exe 1544 wscript.exe 1544 wscript.exe 1544 wscript.exe 1544 wscript.exe 1544 wscript.exe 1544 wscript.exe 1544 wscript.exe 1544 wscript.exe 1544 wscript.exe 1544 wscript.exe 1544 wscript.exe 1544 wscript.exe 1544 wscript.exe 1544 wscript.exe 1544 wscript.exe 1544 wscript.exe - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 3928 ieinstal.exe 3928 ieinstal.exe 3928 ieinstal.exe 1544 wscript.exe 1544 wscript.exe 1544 wscript.exe 1544 wscript.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3928 ieinstal.exe Token: SeDebugPrivilege 1544 wscript.exe Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3816 wrote to memory of 3928 3816 Vyvfiah_Signed_.exe 75 PID 3816 wrote to memory of 3928 3816 Vyvfiah_Signed_.exe 75 PID 3816 wrote to memory of 3928 3816 Vyvfiah_Signed_.exe 75 PID 3816 wrote to memory of 3928 3816 Vyvfiah_Signed_.exe 75 PID 3816 wrote to memory of 3928 3816 Vyvfiah_Signed_.exe 75 PID 3816 wrote to memory of 3928 3816 Vyvfiah_Signed_.exe 75 PID 2996 wrote to memory of 1544 2996 Explorer.EXE 76 PID 2996 wrote to memory of 1544 2996 Explorer.EXE 76 PID 2996 wrote to memory of 1544 2996 Explorer.EXE 76 PID 1544 wrote to memory of 3380 1544 wscript.exe 77 PID 1544 wrote to memory of 3380 1544 wscript.exe 77 PID 1544 wrote to memory of 3380 1544 wscript.exe 77 PID 1544 wrote to memory of 3808 1544 wscript.exe 79 PID 1544 wrote to memory of 3808 1544 wscript.exe 79 PID 1544 wrote to memory of 3808 1544 wscript.exe 79
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\Vyvfiah_Signed_.exe"C:\Users\Admin\AppData\Local\Temp\Vyvfiah_Signed_.exe"2⤵
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3928
-
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:3380
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:3808
-
-