Analysis
- max time kernel
146s - max time network
151s - platform
windows10_x64 - resource
win10v20201028 - submitted
22/12/2020, 08:20
Static task
static1
Behavioral task
behavioral1
Sample
Payment Order Inv.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Payment Order Inv.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target Payment Order Inv.exe
- Size 770KB
- Sample201222-sdnwbnfm6s
- SHA256 5b59e08e82994cd78df8856c5d7cfd4b30be947a9f7329af1a13d47652b189fc
- MD5 66a395765d579f24cf42766d37072416
- SHA1 e1884c073f2a3c11decba1f914e0ca4d3dc0eb11
- SHA512 2fdf5f7f709ba0b77ba7b9707a8f532e1e5019087c1617b6eeaf362d466a40b7d47672d80a61e0a6c8e249c4ddc1f25d697ba51fd8c33d94cc83c11a020dd3e1
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.plantbasedtransporter.com/m98/
Decoy
-
anesbensghair.com
-
crewsquid.com
-
thetekapp.com
-
africaisin.com
-
dodailyworkout.com
-
al-sultangate.com
-
aliciafowens.com
-
bbluebelt3dwdbuy.com
-
qjpay.pro
-
emotionalgun.club
-
guapasnatural.com
-
myessentials2020.com
-
cw-mag.com
-
petrousd.com
-
byyter.com
-
hima-tubusi.com
-
chapelcouture.com
-
thehollowcause.site
-
moskovganteng.com
-
2024project.com
-
olenfex.com
-
caiyisan.com
-
1d2g3m.com
-
aronaw.com
-
frontierautoglasslockport.com
-
pay-misfeel.com
-
noemiluquerodin.com
-
860703.com
-
management-h2g.com
-
chinadrac.com
-
click2hr.com
-
turf-safe.com
-
siltect.com
-
ash3ntv.com
-
carinsurably.com
-
saamacapital.com
-
bruceeng.com
-
agenciaebano.com
-
moscowcity.business
-
yogapants.xyz
-
lagoseyecenter.com
-
forccartex-tw.com
-
mytravel.travel
-
support-login-online.network
-
drinksbyfuego.com
-
quicksigningdoc.com
-
mikmake.net
-
sineflik.com
-
ekreysert.com
-
lifeinspiredgifts.com
-
ezpassnny.com
-
diskrab.com
-
masterbrandcabinetry.com
-
cosplaymaroc.com
-
xr3m.com
-
lakecharlesloan.com
-
parcelwolf.com
-
hellosunnyco.com
-
misery-indexrain.com
-
mysweetdreamsart.com
-
rothretirementsolutions.com
-
conecsa.group
-
onlinepedidos.com
-
learnstartupdesign.com
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- Formbook Payload 3 IoCs
resource yara_rule behavioral2/memory/400-3-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/400-4-0x000000000041EB30-mapping.dmp formbook behavioral2/memory/728-6-0x0000000000000000-mapping.dmp formbook - ModiLoader First Stage 1 IoCs
resource yara_rule behavioral2/memory/1316-2-0x0000000002270000-0x000000000228A000-memory.dmp modiloader_stage1 - Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\User\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run mstsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\B2XDEFVXDHV = "C:\\Program Files (x86)\\internet explorer\\ieinstal.exe" mstsc.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\tjlG = "C:\\Users\\Admin\\AppData\\Local\\tjlG.url" Payment Order Inv.exe Key created \Registry\User\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run mstsc.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1316 set thread context of 400 1316 Payment Order Inv.exe 78 PID 400 set thread context of 2352 400 ieinstal.exe 25 PID 728 set thread context of 2352 728 mstsc.exe 25 -
description ioc Process Key created \Registry\User\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 mstsc.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Payment Order Inv.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Payment Order Inv.exe - Suspicious behavior: EnumeratesProcesses 46 IoCs
pid Process 400 ieinstal.exe 400 ieinstal.exe 400 ieinstal.exe 400 ieinstal.exe 728 mstsc.exe 728 mstsc.exe 728 mstsc.exe 728 mstsc.exe 728 mstsc.exe 728 mstsc.exe 728 mstsc.exe 728 mstsc.exe 728 mstsc.exe 728 mstsc.exe 728 mstsc.exe 728 mstsc.exe 728 mstsc.exe 728 mstsc.exe 728 mstsc.exe 728 mstsc.exe 728 mstsc.exe 728 mstsc.exe 728 mstsc.exe 728 mstsc.exe 728 mstsc.exe 728 mstsc.exe 728 mstsc.exe 728 mstsc.exe 728 mstsc.exe 728 mstsc.exe 728 mstsc.exe 728 mstsc.exe 728 mstsc.exe 728 mstsc.exe 728 mstsc.exe 728 mstsc.exe 728 mstsc.exe 728 mstsc.exe 728 mstsc.exe 728 mstsc.exe 728 mstsc.exe 728 mstsc.exe 728 mstsc.exe 728 mstsc.exe 728 mstsc.exe 728 mstsc.exe - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 400 ieinstal.exe 400 ieinstal.exe 400 ieinstal.exe 728 mstsc.exe 728 mstsc.exe 728 mstsc.exe 728 mstsc.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 400 ieinstal.exe Token: SeDebugPrivilege 728 mstsc.exe Token: SeShutdownPrivilege 2352 Explorer.EXE Token: SeCreatePagefilePrivilege 2352 Explorer.EXE Token: SeShutdownPrivilege 2352 Explorer.EXE Token: SeCreatePagefilePrivilege 2352 Explorer.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2352 Explorer.EXE - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1316 wrote to memory of 400 1316 Payment Order Inv.exe 78 PID 1316 wrote to memory of 400 1316 Payment Order Inv.exe 78 PID 1316 wrote to memory of 400 1316 Payment Order Inv.exe 78 PID 1316 wrote to memory of 400 1316 Payment Order Inv.exe 78 PID 1316 wrote to memory of 400 1316 Payment Order Inv.exe 78 PID 2352 wrote to memory of 728 2352 Explorer.EXE 79 PID 2352 wrote to memory of 728 2352 Explorer.EXE 79 PID 2352 wrote to memory of 728 2352 Explorer.EXE 79 PID 728 wrote to memory of 1568 728 mstsc.exe 80 PID 728 wrote to memory of 1568 728 mstsc.exe 80 PID 728 wrote to memory of 1568 728 mstsc.exe 80
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\Payment Order Inv.exe"C:\Users\Admin\AppData\Local\Temp\Payment Order Inv.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:400
-
-
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:728 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:1568
-
-