Analysis
-
max time kernel
146s -
max time network
138s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
04-01-2021 13:18
Static task
static1
Behavioral task
behavioral1
Sample
December SOA.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
December SOA.exe
Resource
win10v20201028
General
-
Target
December SOA.exe
-
Size
631KB
-
MD5
eeb02ab3b51a522164e83aafa98494e3
-
SHA1
c140ae8539c87fd77cba97f725756a71d25ded84
-
SHA256
383d80ef71e1bd484b6838e3c89eebca3bea49ef0648d3a79564c87aa6ddc00f
-
SHA512
44a467a7886bd38e776769d1b6f2bcf286d57c2ea0492edfb204d3dcc5c7edae5c5585bad7ae354a1c51db91754ebfbba4ef03e43a6cd56288630228296376b4
Malware Config
Extracted
formbook
http://www.plantbasedtransporter.com/m98/
anesbensghair.com
crewsquid.com
thetekapp.com
africaisin.com
dodailyworkout.com
al-sultangate.com
aliciafowens.com
bbluebelt3dwdbuy.com
qjpay.pro
emotionalgun.club
guapasnatural.com
myessentials2020.com
cw-mag.com
petrousd.com
byyter.com
hima-tubusi.com
chapelcouture.com
thehollowcause.site
moskovganteng.com
2024project.com
olenfex.com
caiyisan.com
1d2g3m.com
aronaw.com
frontierautoglasslockport.com
pay-misfeel.com
noemiluquerodin.com
860703.com
management-h2g.com
chinadrac.com
click2hr.com
turf-safe.com
siltect.com
ash3ntv.com
carinsurably.com
saamacapital.com
bruceeng.com
agenciaebano.com
moscowcity.business
yogapants.xyz
lagoseyecenter.com
forccartex-tw.com
mytravel.travel
support-login-online.network
drinksbyfuego.com
quicksigningdoc.com
mikmake.net
sineflik.com
ekreysert.com
lifeinspiredgifts.com
ezpassnny.com
diskrab.com
masterbrandcabinetry.com
cosplaymaroc.com
xr3m.com
lakecharlesloan.com
parcelwolf.com
hellosunnyco.com
misery-indexrain.com
mysweetdreamsart.com
rothretirementsolutions.com
conecsa.group
onlinepedidos.com
learnstartupdesign.com
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1648-4-0x000000000041EB30-mapping.dmp formbook behavioral2/memory/1648-3-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/2260-5-0x0000000000000000-mapping.dmp formbook -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
cmstp.exedescription ioc process Key created \Registry\User\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run cmstp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\6L6HZLEXHTQ = "C:\\Program Files (x86)\\internet explorer\\ieinstal.exe" cmstp.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
December SOA.execmstp.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtzR = "C:\\Users\\Admin\\gtzR.url" December SOA.exe Key created \Registry\User\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run cmstp.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
December SOA.exeieinstal.execmstp.exedescription pid process target process PID 2432 set thread context of 1648 2432 December SOA.exe ieinstal.exe PID 1648 set thread context of 1680 1648 ieinstal.exe Explorer.EXE PID 2260 set thread context of 1680 2260 cmstp.exe Explorer.EXE -
Processes:
cmstp.exedescription ioc process Key created \Registry\User\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cmstp.exe -
Processes:
December SOA.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e December SOA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 December SOA.exe -
Suspicious behavior: EnumeratesProcesses 44 IoCs
Processes:
ieinstal.execmstp.exepid process 1648 ieinstal.exe 1648 ieinstal.exe 1648 ieinstal.exe 1648 ieinstal.exe 2260 cmstp.exe 2260 cmstp.exe 2260 cmstp.exe 2260 cmstp.exe 2260 cmstp.exe 2260 cmstp.exe 2260 cmstp.exe 2260 cmstp.exe 2260 cmstp.exe 2260 cmstp.exe 2260 cmstp.exe 2260 cmstp.exe 2260 cmstp.exe 2260 cmstp.exe 2260 cmstp.exe 2260 cmstp.exe 2260 cmstp.exe 2260 cmstp.exe 2260 cmstp.exe 2260 cmstp.exe 2260 cmstp.exe 2260 cmstp.exe 2260 cmstp.exe 2260 cmstp.exe 2260 cmstp.exe 2260 cmstp.exe 2260 cmstp.exe 2260 cmstp.exe 2260 cmstp.exe 2260 cmstp.exe 2260 cmstp.exe 2260 cmstp.exe 2260 cmstp.exe 2260 cmstp.exe 2260 cmstp.exe 2260 cmstp.exe 2260 cmstp.exe 2260 cmstp.exe 2260 cmstp.exe 2260 cmstp.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
ieinstal.execmstp.exepid process 1648 ieinstal.exe 1648 ieinstal.exe 1648 ieinstal.exe 2260 cmstp.exe 2260 cmstp.exe 2260 cmstp.exe 2260 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
ieinstal.execmstp.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1648 ieinstal.exe Token: SeDebugPrivilege 2260 cmstp.exe Token: SeShutdownPrivilege 1680 Explorer.EXE Token: SeCreatePagefilePrivilege 1680 Explorer.EXE Token: SeShutdownPrivilege 1680 Explorer.EXE Token: SeCreatePagefilePrivilege 1680 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 1680 Explorer.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
December SOA.exeExplorer.EXEcmstp.exedescription pid process target process PID 2432 wrote to memory of 1648 2432 December SOA.exe ieinstal.exe PID 2432 wrote to memory of 1648 2432 December SOA.exe ieinstal.exe PID 2432 wrote to memory of 1648 2432 December SOA.exe ieinstal.exe PID 2432 wrote to memory of 1648 2432 December SOA.exe ieinstal.exe PID 2432 wrote to memory of 1648 2432 December SOA.exe ieinstal.exe PID 1680 wrote to memory of 2260 1680 Explorer.EXE cmstp.exe PID 1680 wrote to memory of 2260 1680 Explorer.EXE cmstp.exe PID 1680 wrote to memory of 2260 1680 Explorer.EXE cmstp.exe PID 2260 wrote to memory of 3096 2260 cmstp.exe Firefox.exe PID 2260 wrote to memory of 3096 2260 cmstp.exe Firefox.exe PID 2260 wrote to memory of 3096 2260 cmstp.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\December SOA.exe"C:\Users\Admin\AppData\Local\Temp\December SOA.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\9486-729\948logim.jpegMD5
f1855cdccb64380f9c9c5771729397c1
SHA1095ca1fce87ab4051d8cc92e40b4f3dc7ee8bcf4
SHA2569db2f104f1b0b20aa1600822cb8dba1dc0eb18de69f59393e83ac6e29a1e61be
SHA512b44cb29e51ffc7967e772866466c85045e3c259dcbd0a516933f7d4c60f9bdad756ad77741c7a22c2b354608cc4249fed0b2cf6080207ccda1aca7a9f2fae232
-
C:\Users\Admin\AppData\Roaming\9486-729\948logrf.iniMD5
2f245469795b865bdd1b956c23d7893d
SHA16ad80b974d3808f5a20ea1e766c7d2f88b9e5895
SHA2561662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361
SHA512909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f
-
C:\Users\Admin\AppData\Roaming\9486-729\948logri.iniMD5
d63a82e5d81e02e399090af26db0b9cb
SHA191d0014c8f54743bba141fd60c9d963f869d76c9
SHA256eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae
SHA51238afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad
-
C:\Users\Admin\AppData\Roaming\9486-729\948logrv.iniMD5
bbc41c78bae6c71e63cb544a6a284d94
SHA133f2c1d9fa0e9c99b80bc2500621e95af38b1f9a
SHA256ee83c6bcea9353c74bfc0a7e739f3c4a765ace894470e09cdcdebba700b8d4cb
SHA5120aea424b57adae3e14ad6491cab585f554b4dffe601b5a17bad6ee6177d2f0f995e419cde576e2d1782b9bddc0661aada11a2c9f1454ae625d9e3223635ec9f4
-
memory/1648-4-0x000000000041EB30-mapping.dmp
-
memory/1648-3-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2260-5-0x0000000000000000-mapping.dmp
-
memory/2260-6-0x00000000013C0000-0x00000000013D6000-memory.dmpFilesize
88KB
-
memory/2260-7-0x00000000013C0000-0x00000000013D6000-memory.dmpFilesize
88KB
-
memory/2432-2-0x0000000002300000-0x0000000002310000-memory.dmpFilesize
64KB
-
memory/3096-8-0x0000000000000000-mapping.dmp
-
memory/3096-11-0x00007FF7B1900000-0x00007FF7B1993000-memory.dmpFilesize
588KB
-
memory/3096-10-0x00007FF7B1900000-0x00007FF7B1993000-memory.dmpFilesize
588KB
-
memory/3096-9-0x00007FF7B1900000-0x00007FF7B1993000-memory.dmpFilesize
588KB