Analysis
- max time kernel
149s - max time network
138s - platform
windows7_x64 - resource
win7v20201028 - submitted
05/11/2020, 09:17
Static task
static1
Behavioral task
behavioral1
Sample
scnn7676766.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
scnn7676766.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target scnn7676766.exe
- Size 1.2MB
- Sample201105-vpemdb72es
- SHA256 2ca6ec7b8f70c8d16ad384a61e4c1cbb9ec02bd51e21648aa5f6af3fd40abd92
- MD5 00456dc029b634d1e4b52f7f117cb5d3
- SHA1 752aa3e1255e29ee28174eacb75799c8b83964db
- SHA512 79dfe4acbaa151a2b7e6a2715bec8c7ca53357d96b95bb72b41ada24d3067554c4b20e69097452f9a06d486e1de0ac504661722f41846856bfc06e09eee8b72f
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.militaryhomedecisions.com/m3px/
Decoy
-
wiscoed.com
-
purecbnwholesale.com
-
propertymanagersfresno.com
-
value.rent
-
lucidmotors.asia
-
decoviewer.com
-
erotichypnotheapist.com
-
watchdoglogistics.com
-
secure05c-chase.com
-
thesleepycook.com
-
342stclairave.com
-
securebrandname.com
-
s53ss.com
-
nibblemirror.com
-
inflamgel.com
-
mansiobok3.info
-
iamprettysad.com
-
vilarealidadeaumentada.com
-
emergingalpha.report
-
kvtlawyers.net
-
pppgrid.life
-
idex.money
-
jxkuljhc.icu
-
amplify-lyf.com
-
leahschick.com
-
liuzongershouche.com
-
caibo1688.com
-
taxdi.com
-
nuclearfusionenergy.info
-
loancairnstudios.com
-
premios2irmaos.com
-
higreen.store
-
wccc21stcclc.community
-
familywealthsurvey.com
-
agroworkshop.com
-
leadinginstylepodcast.com
-
hanneloregilis.com
-
claricitywealthplanning.net
-
mojodealio.com
-
wedpu.com
-
smiledeal.net
-
rhinomanhealth.com
-
shopatman.com
-
ethmob.com
-
mocakavastudios.com
-
ourblyssfullife.com
-
cudnybutik.info
-
bjyysdzs.com
-
client-site-dev.website
-
cankardeslermoda.com
-
ladiesontrail.com
-
twitterrank.net
-
sickbikefairings.com
-
qualifywithkevin.com
-
5yg7lidmzsj9gw.xyz
-
useae.com
-
onemealatatime.net
-
amnestylsbu.info
-
americanhempcrop.com
-
skilleasyacademy.com
-
ccaptive.com
-
lesson.website
-
fruitupshop.com
-
leadershipdefraternite.com
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- Formbook Payload 3 IoCs
resource yara_rule behavioral1/memory/756-2-0x0000000010410000-0x000000001043E000-memory.dmp formbook behavioral1/memory/860-4-0x0000000000000000-mapping.dmp formbook behavioral1/memory/1216-5-0x0000000000000000-mapping.dmp formbook - ModiLoader Second Stage 1 IoCs
resource yara_rule behavioral1/memory/756-1-0x00000000047A0000-0x0000000004801000-memory.dmp modiloader_stage2 - Adds policy Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \Registry\User\S-1-5-21-293278959-2699126792-324916226-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run raserver.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\User\S-1-5-21-293278959-2699126792-324916226-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run raserver.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\XTKDV0Q8WR = "C:\\Program Files (x86)\\internet explorer\\ieinstal.exe" raserver.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 860 set thread context of 1256 860 ieinstal.exe 21 PID 1216 set thread context of 1256 1216 raserver.exe 21 -
description ioc Process Key created \Registry\User\S-1-5-21-293278959-2699126792-324916226-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 raserver.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 scnn7676766.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e scnn7676766.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e scnn7676766.exe - Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 860 ieinstal.exe 860 ieinstal.exe 1216 raserver.exe 1216 raserver.exe 1216 raserver.exe 1216 raserver.exe 1216 raserver.exe 1216 raserver.exe 1216 raserver.exe 1216 raserver.exe 1216 raserver.exe 1216 raserver.exe 1216 raserver.exe 1216 raserver.exe 1216 raserver.exe 1216 raserver.exe 1216 raserver.exe 1216 raserver.exe 1216 raserver.exe 1216 raserver.exe 1216 raserver.exe 1216 raserver.exe 1216 raserver.exe - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 860 ieinstal.exe 860 ieinstal.exe 860 ieinstal.exe 1216 raserver.exe 1216 raserver.exe 1216 raserver.exe 1216 raserver.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 860 ieinstal.exe Token: SeDebugPrivilege 1216 raserver.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 756 wrote to memory of 860 756 scnn7676766.exe 31 PID 756 wrote to memory of 860 756 scnn7676766.exe 31 PID 756 wrote to memory of 860 756 scnn7676766.exe 31 PID 756 wrote to memory of 860 756 scnn7676766.exe 31 PID 756 wrote to memory of 860 756 scnn7676766.exe 31 PID 756 wrote to memory of 860 756 scnn7676766.exe 31 PID 756 wrote to memory of 860 756 scnn7676766.exe 31 PID 756 wrote to memory of 860 756 scnn7676766.exe 31 PID 756 wrote to memory of 860 756 scnn7676766.exe 31 PID 756 wrote to memory of 860 756 scnn7676766.exe 31 PID 1256 wrote to memory of 1216 1256 Explorer.EXE 32 PID 1256 wrote to memory of 1216 1256 Explorer.EXE 32 PID 1256 wrote to memory of 1216 1256 Explorer.EXE 32 PID 1256 wrote to memory of 1216 1256 Explorer.EXE 32 PID 1216 wrote to memory of 928 1216 raserver.exe 33 PID 1216 wrote to memory of 928 1216 raserver.exe 33 PID 1216 wrote to memory of 928 1216 raserver.exe 33 PID 1216 wrote to memory of 928 1216 raserver.exe 33 PID 1216 wrote to memory of 928 1216 raserver.exe 33
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\scnn7676766.exe"C:\Users\Admin\AppData\Local\Temp\scnn7676766.exe"2⤵
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:860
-
-
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:928
-
-