Analysis
-
max time kernel
146s -
max time network
128s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
15-12-2020 17:34
Static task
static1
Behavioral task
behavioral1
Sample
f7519977139336e9138d3a85e7ea547a.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
f7519977139336e9138d3a85e7ea547a.exe
Resource
win10v20201028
General
-
Target
f7519977139336e9138d3a85e7ea547a.exe
-
Size
804KB
-
MD5
f7519977139336e9138d3a85e7ea547a
-
SHA1
538a343385ea9b912742a5b91ce68c1c7201088d
-
SHA256
a80553f1c2dcc35c48adf765bbb4f695d9d3c47d57ab0e47e4e8118588466731
-
SHA512
4cb46216c98c9814e78dd3b3e60c81665ec39894f8514284faffca71fb3e8633325e26e6688f257098a264dff9583d0581e17554cebfd0baa1e0902239cc95b6
Malware Config
Extracted
formbook
http://www.herbmedia.net/csv8/
slgacha.com
oohdough.com
6983ylc.com
aykassociate.com
latin-hotspot.com
starrockindia.com
beamsubway.com
queensboutique1000.com
madbaddie.com
bhoomimart.com
ankitparivar.com
aldanasanchezmx.com
citest1597669833.com
cristianofreitas.com
myplantus.com
counterfeitmilk.com
8xf39.com
pregnantwomens.com
yyyut6.com
stnanguo.com
fessusesefsee.com
logansshop.net
familydalmatianhomes.com
accessible.legal
epicmassiveconcepts.com
indianfactopedia.com
exit-divorce.com
colliapse.com
nosishop.com
hayat-aljowaily.com
soundon.events
previnacovid19-br.com
traptlongview.com
splendidhotelspa.com
masterzushop.com
ednevents.com
studentdividers.com
treningi-enduro.com
hostingcoaster.com
gourmetgroceriesfast.com
thesouthbeachlife.com
teemergin.com
fixmygearfast.com
arb-invest.com
shemaledreamz.com
1819apparel.com
thedigitalsatyam.com
alparmuhendislik.com
distinctmusicproductions.com
procreditexpert.com
insights4innovation.com
jzbtl.com
1033325.com
sorteocamper.info
scheherazadelegault.com
glowportraiture.com
cleitstaapps.com
globepublishers.com
stattests.com
brainandbodystrengthcoach.com
magenx2.info
escaparati.com
wood-decor24.com
travelnetafrica.com
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Xloader Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/612-10-0x0000000000000000-mapping.dmp xloader -
Adds policy Run key to start application 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Key created \Registry\User\S-1-5-21-3825035466-2522850611-591511364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
f7519977139336e9138d3a85e7ea547a.exesvchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ryoB = "C:\\Users\\Admin\\AppData\\Local\\ryoB.url" f7519977139336e9138d3a85e7ea547a.exe Key created \Registry\User\S-1-5-21-3825035466-2522850611-591511364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\HLCLJLW8G = "C:\\Program Files (x86)\\internet explorer\\ieinstal.exe" svchost.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
f7519977139336e9138d3a85e7ea547a.exeieinstal.exesvchost.exedescription pid process target process PID 1944 set thread context of 1652 1944 f7519977139336e9138d3a85e7ea547a.exe ieinstal.exe PID 1652 set thread context of 1236 1652 ieinstal.exe Explorer.EXE PID 612 set thread context of 1236 612 svchost.exe Explorer.EXE -
Processes:
f7519977139336e9138d3a85e7ea547a.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 f7519977139336e9138d3a85e7ea547a.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e f7519977139336e9138d3a85e7ea547a.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e f7519977139336e9138d3a85e7ea547a.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
ieinstal.exesvchost.exepid process 1652 ieinstal.exe 1652 ieinstal.exe 612 svchost.exe 612 svchost.exe 612 svchost.exe 612 svchost.exe 612 svchost.exe 612 svchost.exe 612 svchost.exe 612 svchost.exe 612 svchost.exe 612 svchost.exe 612 svchost.exe 612 svchost.exe 612 svchost.exe 612 svchost.exe 612 svchost.exe 612 svchost.exe 612 svchost.exe 612 svchost.exe 612 svchost.exe 612 svchost.exe 612 svchost.exe 612 svchost.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
ieinstal.exesvchost.exepid process 1652 ieinstal.exe 1652 ieinstal.exe 1652 ieinstal.exe 612 svchost.exe 612 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ieinstal.exesvchost.exedescription pid process Token: SeDebugPrivilege 1652 ieinstal.exe Token: SeDebugPrivilege 612 svchost.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1236 Explorer.EXE 1236 Explorer.EXE 1236 Explorer.EXE 1236 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1236 Explorer.EXE 1236 Explorer.EXE 1236 Explorer.EXE 1236 Explorer.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
f7519977139336e9138d3a85e7ea547a.exeExplorer.EXEdescription pid process target process PID 1944 wrote to memory of 1652 1944 f7519977139336e9138d3a85e7ea547a.exe ieinstal.exe PID 1944 wrote to memory of 1652 1944 f7519977139336e9138d3a85e7ea547a.exe ieinstal.exe PID 1944 wrote to memory of 1652 1944 f7519977139336e9138d3a85e7ea547a.exe ieinstal.exe PID 1944 wrote to memory of 1652 1944 f7519977139336e9138d3a85e7ea547a.exe ieinstal.exe PID 1944 wrote to memory of 1652 1944 f7519977139336e9138d3a85e7ea547a.exe ieinstal.exe PID 1944 wrote to memory of 1652 1944 f7519977139336e9138d3a85e7ea547a.exe ieinstal.exe PID 1944 wrote to memory of 1652 1944 f7519977139336e9138d3a85e7ea547a.exe ieinstal.exe PID 1944 wrote to memory of 1652 1944 f7519977139336e9138d3a85e7ea547a.exe ieinstal.exe PID 1944 wrote to memory of 1652 1944 f7519977139336e9138d3a85e7ea547a.exe ieinstal.exe PID 1236 wrote to memory of 612 1236 Explorer.EXE svchost.exe PID 1236 wrote to memory of 612 1236 Explorer.EXE svchost.exe PID 1236 wrote to memory of 612 1236 Explorer.EXE svchost.exe PID 1236 wrote to memory of 612 1236 Explorer.EXE svchost.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f7519977139336e9138d3a85e7ea547a.exe"C:\Users\Admin\AppData\Local\Temp\f7519977139336e9138d3a85e7ea547a.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/612-10-0x0000000000000000-mapping.dmp
-
memory/612-11-0x0000000000190000-0x0000000000198000-memory.dmpFilesize
32KB
-
memory/612-12-0x00000000042E0000-0x0000000004422000-memory.dmpFilesize
1.3MB
-
memory/1084-4-0x000007FEF6080000-0x000007FEF62FA000-memory.dmpFilesize
2.5MB
-
memory/1652-7-0x0000000000530000-0x000000000055B000-memory.dmpFilesize
172KB
-
memory/1652-8-0x0000000000531598-mapping.dmp
-
memory/1652-9-0x0000000000530000-0x000000000055B000-memory.dmpFilesize
172KB
-
memory/1944-2-0x00000000003E0000-0x00000000003F3000-memory.dmpFilesize
76KB
-
memory/1944-5-0x0000000004440000-0x000000000448C000-memory.dmpFilesize
304KB