Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
30-03-2021 13:41
Static task
static1
Behavioral task
behavioral1
Sample
Attached pdf.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Attached pdf.exe
Resource
win10v20201028
General
-
Target
Attached pdf.exe
-
Size
617KB
-
MD5
83c9cee1f209ec02934e3895d5c51dfa
-
SHA1
2ba1dac5e2fef7a948b21efcc267b3096656cf68
-
SHA256
93e8c5b7f7c4b18efb1f1c09c5ad9c5d8782611b9417f19063cdd17f3cdd92ee
-
SHA512
2df5a3c0f01f3aed5dd1d1cee3ef30e99b0b7e5e1692c6818f720d6d00bcb2b23a56b2334422ae618a57ffe87ceab0c5b54d6d43bfd463e77956eaa3feb656a2
Malware Config
Extracted
remcos
rem1.camdvr.org:2404
rem16.hopto.org:2404
rem1666.hopto.org:2404
rem16.camdvr.org:2404
remmusic.freeddns.org:2404
sunwap1.ddns.net:2404
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/1020-20-0x0000000000455238-mapping.dmp MailPassView -
NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/1912-16-0x0000000000476274-mapping.dmp WebBrowserPassView -
Nirsoft 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1912-16-0x0000000000476274-mapping.dmp Nirsoft behavioral2/memory/1020-20-0x0000000000455238-mapping.dmp Nirsoft -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Attached pdf.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Znoaho = "C:\\Users\\Public\\Libraries\\ohaonZ.url" Attached pdf.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
ieinstal.exedescription pid process target process PID 2496 set thread context of 1912 2496 ieinstal.exe ieinstal.exe PID 2496 set thread context of 1540 2496 ieinstal.exe ieinstal.exe PID 2496 set thread context of 1020 2496 ieinstal.exe ieinstal.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 17 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
ieinstal.exeieinstal.exepid process 1912 ieinstal.exe 1912 ieinstal.exe 1540 ieinstal.exe 1540 ieinstal.exe 1912 ieinstal.exe 1912 ieinstal.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ieinstal.exedescription pid process Token: SeDebugPrivilege 1540 ieinstal.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ieinstal.exepid process 2496 ieinstal.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
Attached pdf.exeieinstal.exedescription pid process target process PID 3996 wrote to memory of 2496 3996 Attached pdf.exe ieinstal.exe PID 3996 wrote to memory of 2496 3996 Attached pdf.exe ieinstal.exe PID 3996 wrote to memory of 2496 3996 Attached pdf.exe ieinstal.exe PID 3996 wrote to memory of 2496 3996 Attached pdf.exe ieinstal.exe PID 3996 wrote to memory of 2496 3996 Attached pdf.exe ieinstal.exe PID 3996 wrote to memory of 2496 3996 Attached pdf.exe ieinstal.exe PID 3996 wrote to memory of 2496 3996 Attached pdf.exe ieinstal.exe PID 3996 wrote to memory of 2496 3996 Attached pdf.exe ieinstal.exe PID 3996 wrote to memory of 2496 3996 Attached pdf.exe ieinstal.exe PID 3996 wrote to memory of 2496 3996 Attached pdf.exe ieinstal.exe PID 3996 wrote to memory of 2496 3996 Attached pdf.exe ieinstal.exe PID 3996 wrote to memory of 2496 3996 Attached pdf.exe ieinstal.exe PID 3996 wrote to memory of 2496 3996 Attached pdf.exe ieinstal.exe PID 3996 wrote to memory of 2496 3996 Attached pdf.exe ieinstal.exe PID 3996 wrote to memory of 2496 3996 Attached pdf.exe ieinstal.exe PID 2496 wrote to memory of 1912 2496 ieinstal.exe ieinstal.exe PID 2496 wrote to memory of 1912 2496 ieinstal.exe ieinstal.exe PID 2496 wrote to memory of 1912 2496 ieinstal.exe ieinstal.exe PID 2496 wrote to memory of 1912 2496 ieinstal.exe ieinstal.exe PID 2496 wrote to memory of 1912 2496 ieinstal.exe ieinstal.exe PID 2496 wrote to memory of 1912 2496 ieinstal.exe ieinstal.exe PID 2496 wrote to memory of 1912 2496 ieinstal.exe ieinstal.exe PID 2496 wrote to memory of 1912 2496 ieinstal.exe ieinstal.exe PID 2496 wrote to memory of 1540 2496 ieinstal.exe ieinstal.exe PID 2496 wrote to memory of 1540 2496 ieinstal.exe ieinstal.exe PID 2496 wrote to memory of 1540 2496 ieinstal.exe ieinstal.exe PID 2496 wrote to memory of 1540 2496 ieinstal.exe ieinstal.exe PID 2496 wrote to memory of 1540 2496 ieinstal.exe ieinstal.exe PID 2496 wrote to memory of 1540 2496 ieinstal.exe ieinstal.exe PID 2496 wrote to memory of 1540 2496 ieinstal.exe ieinstal.exe PID 2496 wrote to memory of 1540 2496 ieinstal.exe ieinstal.exe PID 2496 wrote to memory of 1020 2496 ieinstal.exe ieinstal.exe PID 2496 wrote to memory of 1020 2496 ieinstal.exe ieinstal.exe PID 2496 wrote to memory of 1020 2496 ieinstal.exe ieinstal.exe PID 2496 wrote to memory of 1020 2496 ieinstal.exe ieinstal.exe PID 2496 wrote to memory of 1020 2496 ieinstal.exe ieinstal.exe PID 2496 wrote to memory of 1020 2496 ieinstal.exe ieinstal.exe PID 2496 wrote to memory of 1020 2496 ieinstal.exe ieinstal.exe PID 2496 wrote to memory of 1020 2496 ieinstal.exe ieinstal.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Attached pdf.exe"C:\Users\Admin\AppData\Local\Temp\Attached pdf.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe" /stext "C:\Users\Admin\AppData\Local\Temp\szqwxykuvcrxpugqkyjlv"3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe" /stext "C:\Users\Admin\AppData\Local\Temp\utdpyruvrkkkaauutjefyrhx"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe" /stext "C:\Users\Admin\AppData\Local\Temp\fwjazjfpfscpcoqgktqgjwcgeow"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\szqwxykuvcrxpugqkyjlvMD5
814b5ce4cad79d36055d2d4b5958cc31
SHA12a06a869615f0858479371b0415899681fb0c7d8
SHA2566d1fa1a75faec2b39e8a2a1df8dd0f15e5256de7da7c527225ecf22fdacaf559
SHA512a82fa1594ccbe1df93a973a01c787a6baa0ce8a97c0b0b0a844c90cb6be092b1094636b4d88c568fece95cd9bdfe4412875011abe318373a4fcfc218f93d1278
-
memory/1020-24-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1020-19-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1020-20-0x0000000000455238-mapping.dmp
-
memory/1540-17-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/1540-22-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/1540-18-0x0000000000422206-mapping.dmp
-
memory/1912-21-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/1912-15-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/1912-16-0x0000000000476274-mapping.dmp
-
memory/2496-13-0x0000000010540000-0x0000000010564000-memory.dmpFilesize
144KB
-
memory/2496-14-0x0000000000480000-0x00000000004A2000-memory.dmpFilesize
136KB
-
memory/2496-8-0x0000000000410000-0x0000000000411000-memory.dmpFilesize
4KB
-
memory/2496-6-0x0000000000470000-0x0000000000471000-memory.dmpFilesize
4KB
-
memory/2496-5-0x0000000000000000-mapping.dmp
-
memory/2496-4-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/3996-2-0x00000000021E0000-0x00000000021E1000-memory.dmpFilesize
4KB