Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
12-04-2021 17:38
Static task
static1
Behavioral task
behavioral1
Sample
Dringende Bestellung Zitat CTX88467638,pdf.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Dringende Bestellung Zitat CTX88467638,pdf.exe
Resource
win10v20210410
General
-
Target
Dringende Bestellung Zitat CTX88467638,pdf.exe
-
Size
769KB
-
MD5
66525016cb1f9420e5e5c178082346cf
-
SHA1
afe3c32389f0009959d9de94feb11e2bf1f1abd7
-
SHA256
0f3cac160b09665561487322c11c5ee1ad0eb221b32edfecf1fe01d5b5f278f7
-
SHA512
26eefff0cdc04747ccfb432c0154ec271b2b9ad6ead105fe0f9cd07ba08df05f13d15771eafaeec9912acf02b289ecde134d56c5c398198c9c256b6580058d7c
Malware Config
Extracted
remcos
ongod4life.ddns.net:4344
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Dringende Bestellung Zitat CTX88467638,pdf.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ntozkw = "C:\\Users\\Public\\Libraries\\wkzotN.url" Dringende Bestellung Zitat CTX88467638,pdf.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Dringende Bestellung Zitat CTX88467638,pdf.exedescription pid process target process PID 2208 wrote to memory of 4064 2208 Dringende Bestellung Zitat CTX88467638,pdf.exe ieinstal.exe PID 2208 wrote to memory of 4064 2208 Dringende Bestellung Zitat CTX88467638,pdf.exe ieinstal.exe PID 2208 wrote to memory of 4064 2208 Dringende Bestellung Zitat CTX88467638,pdf.exe ieinstal.exe PID 2208 wrote to memory of 4064 2208 Dringende Bestellung Zitat CTX88467638,pdf.exe ieinstal.exe PID 2208 wrote to memory of 4064 2208 Dringende Bestellung Zitat CTX88467638,pdf.exe ieinstal.exe PID 2208 wrote to memory of 4064 2208 Dringende Bestellung Zitat CTX88467638,pdf.exe ieinstal.exe PID 2208 wrote to memory of 4064 2208 Dringende Bestellung Zitat CTX88467638,pdf.exe ieinstal.exe PID 2208 wrote to memory of 4064 2208 Dringende Bestellung Zitat CTX88467638,pdf.exe ieinstal.exe PID 2208 wrote to memory of 4064 2208 Dringende Bestellung Zitat CTX88467638,pdf.exe ieinstal.exe PID 2208 wrote to memory of 4064 2208 Dringende Bestellung Zitat CTX88467638,pdf.exe ieinstal.exe PID 2208 wrote to memory of 4064 2208 Dringende Bestellung Zitat CTX88467638,pdf.exe ieinstal.exe PID 2208 wrote to memory of 4064 2208 Dringende Bestellung Zitat CTX88467638,pdf.exe ieinstal.exe PID 2208 wrote to memory of 4064 2208 Dringende Bestellung Zitat CTX88467638,pdf.exe ieinstal.exe PID 2208 wrote to memory of 4064 2208 Dringende Bestellung Zitat CTX88467638,pdf.exe ieinstal.exe PID 2208 wrote to memory of 4064 2208 Dringende Bestellung Zitat CTX88467638,pdf.exe ieinstal.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Dringende Bestellung Zitat CTX88467638,pdf.exe"C:\Users\Admin\AppData\Local\Temp\Dringende Bestellung Zitat CTX88467638,pdf.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2208-114-0x00000000005B0000-0x00000000006FA000-memory.dmpFilesize
1.3MB
-
memory/2208-116-0x00000000028C0000-0x00000000028DA000-memory.dmpFilesize
104KB
-
memory/4064-119-0x0000000000000000-mapping.dmp
-
memory/4064-121-0x0000000003050000-0x0000000003051000-memory.dmpFilesize
4KB
-
memory/4064-120-0x0000000002D90000-0x0000000002D91000-memory.dmpFilesize
4KB
-
memory/4064-124-0x0000000010540000-0x0000000010564000-memory.dmpFilesize
144KB
-
memory/4064-125-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/4064-123-0x0000000003010000-0x0000000003011000-memory.dmpFilesize
4KB