Analysis
-
max time kernel
147s -
max time network
145s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
04-01-2021 13:18
Static task
static1
Behavioral task
behavioral1
Sample
December SOA.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
December SOA.exe
Resource
win10v20201028
General
-
Target
December SOA.exe
-
Size
631KB
-
MD5
eeb02ab3b51a522164e83aafa98494e3
-
SHA1
c140ae8539c87fd77cba97f725756a71d25ded84
-
SHA256
383d80ef71e1bd484b6838e3c89eebca3bea49ef0648d3a79564c87aa6ddc00f
-
SHA512
44a467a7886bd38e776769d1b6f2bcf286d57c2ea0492edfb204d3dcc5c7edae5c5585bad7ae354a1c51db91754ebfbba4ef03e43a6cd56288630228296376b4
Malware Config
Extracted
formbook
http://www.plantbasedtransporter.com/m98/
anesbensghair.com
crewsquid.com
thetekapp.com
africaisin.com
dodailyworkout.com
al-sultangate.com
aliciafowens.com
bbluebelt3dwdbuy.com
qjpay.pro
emotionalgun.club
guapasnatural.com
myessentials2020.com
cw-mag.com
petrousd.com
byyter.com
hima-tubusi.com
chapelcouture.com
thehollowcause.site
moskovganteng.com
2024project.com
olenfex.com
caiyisan.com
1d2g3m.com
aronaw.com
frontierautoglasslockport.com
pay-misfeel.com
noemiluquerodin.com
860703.com
management-h2g.com
chinadrac.com
click2hr.com
turf-safe.com
siltect.com
ash3ntv.com
carinsurably.com
saamacapital.com
bruceeng.com
agenciaebano.com
moscowcity.business
yogapants.xyz
lagoseyecenter.com
forccartex-tw.com
mytravel.travel
support-login-online.network
drinksbyfuego.com
quicksigningdoc.com
mikmake.net
sineflik.com
ekreysert.com
lifeinspiredgifts.com
ezpassnny.com
diskrab.com
masterbrandcabinetry.com
cosplaymaroc.com
xr3m.com
lakecharlesloan.com
parcelwolf.com
hellosunnyco.com
misery-indexrain.com
mysweetdreamsart.com
rothretirementsolutions.com
conecsa.group
onlinepedidos.com
learnstartupdesign.com
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1492-4-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1492-5-0x000000000041EB30-mapping.dmp formbook behavioral1/memory/916-7-0x0000000000000000-mapping.dmp formbook -
Adds policy Run key to start application 2 TTPs 1 IoCs
Processes:
ipconfig.exedescription ioc process Key created \Registry\User\S-1-5-21-3825035466-2522850611-591511364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run ipconfig.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
December SOA.exeipconfig.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtzR = "C:\\Users\\Admin\\gtzR.url" December SOA.exe Key created \Registry\User\S-1-5-21-3825035466-2522850611-591511364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ipconfig.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\HTLHUR5XGVH = "C:\\Program Files (x86)\\internet explorer\\ieinstal.exe" ipconfig.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
December SOA.exeieinstal.exeipconfig.exedescription pid process target process PID 1696 set thread context of 1492 1696 December SOA.exe ieinstal.exe PID 1492 set thread context of 1248 1492 ieinstal.exe Explorer.EXE PID 1492 set thread context of 1248 1492 ieinstal.exe Explorer.EXE PID 916 set thread context of 1248 916 ipconfig.exe Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 916 ipconfig.exe -
Processes:
ipconfig.exedescription ioc process Key created \Registry\User\S-1-5-21-3825035466-2522850611-591511364-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 ipconfig.exe -
Processes:
December SOA.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 December SOA.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e December SOA.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e December SOA.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
ieinstal.exeipconfig.exepid process 1492 ieinstal.exe 1492 ieinstal.exe 1492 ieinstal.exe 916 ipconfig.exe 916 ipconfig.exe 916 ipconfig.exe 916 ipconfig.exe 916 ipconfig.exe 916 ipconfig.exe 916 ipconfig.exe 916 ipconfig.exe 916 ipconfig.exe 916 ipconfig.exe 916 ipconfig.exe 916 ipconfig.exe 916 ipconfig.exe 916 ipconfig.exe 916 ipconfig.exe 916 ipconfig.exe 916 ipconfig.exe 916 ipconfig.exe 916 ipconfig.exe -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
ieinstal.exeipconfig.exepid process 1492 ieinstal.exe 1492 ieinstal.exe 1492 ieinstal.exe 1492 ieinstal.exe 916 ipconfig.exe 916 ipconfig.exe 916 ipconfig.exe 916 ipconfig.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ieinstal.exeipconfig.exedescription pid process Token: SeDebugPrivilege 1492 ieinstal.exe Token: SeDebugPrivilege 916 ipconfig.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
Processes:
Explorer.EXEpid process 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE -
Suspicious use of SendNotifyMessage 6 IoCs
Processes:
Explorer.EXEpid process 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
December SOA.exeExplorer.EXEipconfig.exedescription pid process target process PID 1696 wrote to memory of 1492 1696 December SOA.exe ieinstal.exe PID 1696 wrote to memory of 1492 1696 December SOA.exe ieinstal.exe PID 1696 wrote to memory of 1492 1696 December SOA.exe ieinstal.exe PID 1696 wrote to memory of 1492 1696 December SOA.exe ieinstal.exe PID 1696 wrote to memory of 1492 1696 December SOA.exe ieinstal.exe PID 1696 wrote to memory of 1492 1696 December SOA.exe ieinstal.exe PID 1696 wrote to memory of 1492 1696 December SOA.exe ieinstal.exe PID 1696 wrote to memory of 1492 1696 December SOA.exe ieinstal.exe PID 1696 wrote to memory of 1492 1696 December SOA.exe ieinstal.exe PID 1248 wrote to memory of 916 1248 Explorer.EXE ipconfig.exe PID 1248 wrote to memory of 916 1248 Explorer.EXE ipconfig.exe PID 1248 wrote to memory of 916 1248 Explorer.EXE ipconfig.exe PID 1248 wrote to memory of 916 1248 Explorer.EXE ipconfig.exe PID 916 wrote to memory of 624 916 ipconfig.exe Firefox.exe PID 916 wrote to memory of 624 916 ipconfig.exe Firefox.exe PID 916 wrote to memory of 624 916 ipconfig.exe Firefox.exe PID 916 wrote to memory of 624 916 ipconfig.exe Firefox.exe PID 916 wrote to memory of 624 916 ipconfig.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\December SOA.exe"C:\Users\Admin\AppData\Local\Temp\December SOA.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Gathers network information
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\9486-729\948logim.jpegMD5
1ced1b16fb68b0ab4e4f688373152394
SHA14b5d912273aae83a8889be48704528cac5362910
SHA2563efc600d7b271fa64300b246724cb6a089ed4f142b0055f0d59f2d8304d2d40b
SHA51262010ca74335fa034c43c265c061477f05a43566fbf27f48c7b509abc7638e50e04582f3cd52508d64421a45daad25879120244f2511a824e75eb7f0e2d71f81
-
C:\Users\Admin\AppData\Roaming\9486-729\948logrf.iniMD5
2f245469795b865bdd1b956c23d7893d
SHA16ad80b974d3808f5a20ea1e766c7d2f88b9e5895
SHA2561662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361
SHA512909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f
-
C:\Users\Admin\AppData\Roaming\9486-729\948logri.iniMD5
d63a82e5d81e02e399090af26db0b9cb
SHA191d0014c8f54743bba141fd60c9d963f869d76c9
SHA256eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae
SHA51238afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad
-
C:\Users\Admin\AppData\Roaming\9486-729\948logrv.iniMD5
ba3b6bc807d4f76794c4b81b09bb9ba5
SHA124cb89501f0212ff3095ecc0aba97dd563718fb1
SHA2566eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507
SHA512ecd07e601fc9e3cfc39addd7bd6f3d7f7ff3253afb40bf536e9eaac5a4c243e5ec40fbfd7b216cb0ea29f2517419601e335e33ba19dea4a46f65e38694d465bf
-
memory/624-11-0x0000000000000000-mapping.dmp
-
memory/624-12-0x000000013FA40000-0x000000013FAD3000-memory.dmpFilesize
588KB
-
memory/916-8-0x0000000000EA0000-0x0000000000EAA000-memory.dmpFilesize
40KB
-
memory/916-9-0x0000000003080000-0x000000000315A000-memory.dmpFilesize
872KB
-
memory/916-10-0x0000000003AE0000-0x0000000003BF6000-memory.dmpFilesize
1.1MB
-
memory/916-7-0x0000000000000000-mapping.dmp
-
memory/1248-6-0x00000000068A0000-0x0000000006999000-memory.dmpFilesize
996KB
-
memory/1296-3-0x000007FEF7D90000-0x000007FEF800A000-memory.dmpFilesize
2.5MB
-
memory/1492-5-0x000000000041EB30-mapping.dmp
-
memory/1492-4-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1696-2-0x00000000002B0000-0x00000000002C0000-memory.dmpFilesize
64KB