Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
12-04-2021 09:05
Static task
static1
Behavioral task
behavioral1
Sample
Dringende Bestellung Zitat CTX88467638,pdf.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Dringende Bestellung Zitat CTX88467638,pdf.exe
Resource
win10v20201028
General
-
Target
Dringende Bestellung Zitat CTX88467638,pdf.exe
-
Size
769KB
-
MD5
66525016cb1f9420e5e5c178082346cf
-
SHA1
afe3c32389f0009959d9de94feb11e2bf1f1abd7
-
SHA256
0f3cac160b09665561487322c11c5ee1ad0eb221b32edfecf1fe01d5b5f278f7
-
SHA512
26eefff0cdc04747ccfb432c0154ec271b2b9ad6ead105fe0f9cd07ba08df05f13d15771eafaeec9912acf02b289ecde134d56c5c398198c9c256b6580058d7c
Malware Config
Extracted
remcos
ongod4life.ddns.net:4344
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Dringende Bestellung Zitat CTX88467638,pdf.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ntozkw = "C:\\Users\\Public\\Libraries\\wkzotN.url" Dringende Bestellung Zitat CTX88467638,pdf.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
Dringende Bestellung Zitat CTX88467638,pdf.exedescription pid process target process PID 1964 wrote to memory of 368 1964 Dringende Bestellung Zitat CTX88467638,pdf.exe ieinstal.exe PID 1964 wrote to memory of 368 1964 Dringende Bestellung Zitat CTX88467638,pdf.exe ieinstal.exe PID 1964 wrote to memory of 368 1964 Dringende Bestellung Zitat CTX88467638,pdf.exe ieinstal.exe PID 1964 wrote to memory of 368 1964 Dringende Bestellung Zitat CTX88467638,pdf.exe ieinstal.exe PID 1964 wrote to memory of 368 1964 Dringende Bestellung Zitat CTX88467638,pdf.exe ieinstal.exe PID 1964 wrote to memory of 368 1964 Dringende Bestellung Zitat CTX88467638,pdf.exe ieinstal.exe PID 1964 wrote to memory of 368 1964 Dringende Bestellung Zitat CTX88467638,pdf.exe ieinstal.exe PID 1964 wrote to memory of 368 1964 Dringende Bestellung Zitat CTX88467638,pdf.exe ieinstal.exe PID 1964 wrote to memory of 368 1964 Dringende Bestellung Zitat CTX88467638,pdf.exe ieinstal.exe PID 1964 wrote to memory of 368 1964 Dringende Bestellung Zitat CTX88467638,pdf.exe ieinstal.exe PID 1964 wrote to memory of 368 1964 Dringende Bestellung Zitat CTX88467638,pdf.exe ieinstal.exe PID 1964 wrote to memory of 368 1964 Dringende Bestellung Zitat CTX88467638,pdf.exe ieinstal.exe PID 1964 wrote to memory of 368 1964 Dringende Bestellung Zitat CTX88467638,pdf.exe ieinstal.exe PID 1964 wrote to memory of 368 1964 Dringende Bestellung Zitat CTX88467638,pdf.exe ieinstal.exe PID 1964 wrote to memory of 368 1964 Dringende Bestellung Zitat CTX88467638,pdf.exe ieinstal.exe PID 1964 wrote to memory of 368 1964 Dringende Bestellung Zitat CTX88467638,pdf.exe ieinstal.exe PID 1964 wrote to memory of 368 1964 Dringende Bestellung Zitat CTX88467638,pdf.exe ieinstal.exe PID 1964 wrote to memory of 368 1964 Dringende Bestellung Zitat CTX88467638,pdf.exe ieinstal.exe PID 1964 wrote to memory of 368 1964 Dringende Bestellung Zitat CTX88467638,pdf.exe ieinstal.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Dringende Bestellung Zitat CTX88467638,pdf.exe"C:\Users\Admin\AppData\Local\Temp\Dringende Bestellung Zitat CTX88467638,pdf.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/368-65-0x0000000000000000-mapping.dmp
-
memory/368-67-0x0000000000110000-0x0000000000111000-memory.dmpFilesize
4KB
-
memory/368-70-0x0000000010540000-0x0000000010564000-memory.dmpFilesize
144KB
-
memory/368-71-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/368-72-0x00000000000D0000-0x00000000000D1000-memory.dmpFilesize
4KB
-
memory/368-69-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/1964-59-0x0000000075ED1000-0x0000000075ED3000-memory.dmpFilesize
8KB
-
memory/1964-60-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1964-62-0x0000000001DF0000-0x0000000001E0A000-memory.dmpFilesize
104KB