Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
13-04-2021 07:02
Static task
static1
Behavioral task
behavioral1
Sample
Devis de commande urgent SDX88467638,pdf.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Devis de commande urgent SDX88467638,pdf.exe
Resource
win10v20210408
General
-
Target
Devis de commande urgent SDX88467638,pdf.exe
-
Size
838KB
-
MD5
3cbd690be25928be30b522ad04785ef5
-
SHA1
e2f8ab8ceaaa0bf2a65fd8291f1355a58ad66561
-
SHA256
2644d67e0fbbce929f70bdc4c07912617a2a65e611faeb72acd51a091e529a5e
-
SHA512
388334e5ddc09edaefffa1050c6c2e6a5bbc88c24d1973b0fbfbb69a8fcace4d985e8166bbebc5d767749fde55b8fd2251f9bd9f6499f8f984c14f1d59c9a9e7
Malware Config
Extracted
remcos
ongod4life.ddns.net:4344
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Executes dropped EXE 2 IoCs
Processes:
Netplwiz.exeNetplwiz.exepid process 556 Netplwiz.exe 904 Netplwiz.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Devis de commande urgent SDX88467638,pdf.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Uatyvc = "C:\\Users\\Public\\Libraries\\cvytaU.url" Devis de commande urgent SDX88467638,pdf.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
Devis de commande urgent SDX88467638,pdf.exedescription ioc process File opened (read-only) \??\Z: Devis de commande urgent SDX88467638,pdf.exe File opened (read-only) \??\E: Devis de commande urgent SDX88467638,pdf.exe File opened (read-only) \??\O: Devis de commande urgent SDX88467638,pdf.exe File opened (read-only) \??\Q: Devis de commande urgent SDX88467638,pdf.exe File opened (read-only) \??\S: Devis de commande urgent SDX88467638,pdf.exe File opened (read-only) \??\V: Devis de commande urgent SDX88467638,pdf.exe File opened (read-only) \??\W: Devis de commande urgent SDX88467638,pdf.exe File opened (read-only) \??\Y: Devis de commande urgent SDX88467638,pdf.exe File opened (read-only) \??\H: Devis de commande urgent SDX88467638,pdf.exe File opened (read-only) \??\J: Devis de commande urgent SDX88467638,pdf.exe File opened (read-only) \??\K: Devis de commande urgent SDX88467638,pdf.exe File opened (read-only) \??\M: Devis de commande urgent SDX88467638,pdf.exe File opened (read-only) \??\N: Devis de commande urgent SDX88467638,pdf.exe File opened (read-only) \??\U: Devis de commande urgent SDX88467638,pdf.exe File opened (read-only) \??\X: Devis de commande urgent SDX88467638,pdf.exe File opened (read-only) \??\B: Devis de commande urgent SDX88467638,pdf.exe File opened (read-only) \??\G: Devis de commande urgent SDX88467638,pdf.exe File opened (read-only) \??\I: Devis de commande urgent SDX88467638,pdf.exe File opened (read-only) \??\L: Devis de commande urgent SDX88467638,pdf.exe File opened (read-only) \??\P: Devis de commande urgent SDX88467638,pdf.exe File opened (read-only) \??\T: Devis de commande urgent SDX88467638,pdf.exe File opened (read-only) \??\A: Devis de commande urgent SDX88467638,pdf.exe File opened (read-only) \??\F: Devis de commande urgent SDX88467638,pdf.exe File opened (read-only) \??\R: Devis de commande urgent SDX88467638,pdf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
Devis de commande urgent SDX88467638,pdf.execmd.exedescription pid process target process PID 1676 wrote to memory of 672 1676 Devis de commande urgent SDX88467638,pdf.exe ieinstal.exe PID 1676 wrote to memory of 672 1676 Devis de commande urgent SDX88467638,pdf.exe ieinstal.exe PID 1676 wrote to memory of 672 1676 Devis de commande urgent SDX88467638,pdf.exe ieinstal.exe PID 1676 wrote to memory of 672 1676 Devis de commande urgent SDX88467638,pdf.exe ieinstal.exe PID 1676 wrote to memory of 672 1676 Devis de commande urgent SDX88467638,pdf.exe ieinstal.exe PID 1676 wrote to memory of 672 1676 Devis de commande urgent SDX88467638,pdf.exe ieinstal.exe PID 1676 wrote to memory of 672 1676 Devis de commande urgent SDX88467638,pdf.exe ieinstal.exe PID 1676 wrote to memory of 672 1676 Devis de commande urgent SDX88467638,pdf.exe ieinstal.exe PID 1676 wrote to memory of 672 1676 Devis de commande urgent SDX88467638,pdf.exe ieinstal.exe PID 1676 wrote to memory of 672 1676 Devis de commande urgent SDX88467638,pdf.exe ieinstal.exe PID 1676 wrote to memory of 672 1676 Devis de commande urgent SDX88467638,pdf.exe ieinstal.exe PID 1676 wrote to memory of 672 1676 Devis de commande urgent SDX88467638,pdf.exe ieinstal.exe PID 1676 wrote to memory of 672 1676 Devis de commande urgent SDX88467638,pdf.exe ieinstal.exe PID 1676 wrote to memory of 672 1676 Devis de commande urgent SDX88467638,pdf.exe ieinstal.exe PID 1676 wrote to memory of 672 1676 Devis de commande urgent SDX88467638,pdf.exe ieinstal.exe PID 1676 wrote to memory of 672 1676 Devis de commande urgent SDX88467638,pdf.exe ieinstal.exe PID 1676 wrote to memory of 672 1676 Devis de commande urgent SDX88467638,pdf.exe ieinstal.exe PID 1676 wrote to memory of 672 1676 Devis de commande urgent SDX88467638,pdf.exe ieinstal.exe PID 1676 wrote to memory of 672 1676 Devis de commande urgent SDX88467638,pdf.exe ieinstal.exe PID 1676 wrote to memory of 1140 1676 Devis de commande urgent SDX88467638,pdf.exe cmd.exe PID 1676 wrote to memory of 1140 1676 Devis de commande urgent SDX88467638,pdf.exe cmd.exe PID 1676 wrote to memory of 1140 1676 Devis de commande urgent SDX88467638,pdf.exe cmd.exe PID 1676 wrote to memory of 1140 1676 Devis de commande urgent SDX88467638,pdf.exe cmd.exe PID 1140 wrote to memory of 1784 1140 cmd.exe cmd.exe PID 1140 wrote to memory of 1784 1140 cmd.exe cmd.exe PID 1140 wrote to memory of 1784 1140 cmd.exe cmd.exe PID 1140 wrote to memory of 1784 1140 cmd.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Devis de commande urgent SDX88467638,pdf.exe"C:\Users\Admin\AppData\Local\Temp\Devis de commande urgent SDX88467638,pdf.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Public\stt.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Public\PXOR.bat3⤵
-
C:\Windows \System32\Netplwiz.exe"C:\Windows \System32\Netplwiz.exe"4⤵
- Executes dropped EXE
-
C:\Windows \System32\Netplwiz.exe"C:\Windows \System32\Netplwiz.exe"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\NETUTILS.dllMD5
39507d772c63ca496a25a14a8b5d14b2
SHA15b603f5c11eb9ab4313694315b4d4894ff4641d4
SHA25636d1fa474cd8271f9b74b9481025614b6ff309f767f69d9f1ff3960c7205ad12
SHA5120c740fd7b6d67d9938b0d8e1ea7d6c41910dd6d0b85b4ec8b6015ff8c0c73798dee01f01da0b5b0c07038663aca7945faca0e2b5afc1cb751aaba7567d332f5f
-
C:\Users\Public\Netplwiz.exeMD5
f94b7fb6dac49844d03c7087b2d8b472
SHA10e84139fced0ee8ef929d0bd5f01559a7dcf1db0
SHA25646e31f337ed0d9a6fe3f159abc91c9b9b6a6062982bbcd84a51784d7128e7ae4
SHA512d63878f94f7699e4cc63c2cd885c29455e0c423d32dba750e4fc3aa74dbaca80a1a4b176719213b9fc6584de6a40cddff7864c7fb4cfba13dfcb437a36e41b80
-
C:\Users\Public\PXOR.batMD5
0d8aef656413642f55e0902cc5df5e6f
SHA173ec56d08bd9b3c45d55c97bd1c1286b77c8ff49
SHA256670f94b92f45bc2f3f44a80c7f3021f874aa16fde38ed7d7f3ebed13ae09fa11
SHA512efe690b1bcf06e16be469622b45c98b5dc1f1e06410cbf7e7dccb2975524c4d6bc7e23de9a129d50d73cd924f02e23f925555894f2c7da1064dcc57151f50876
-
C:\Users\Public\stt.batMD5
8a850253c31df9a7e1c00c80df2630d5
SHA1e3da74081b027a3b591488b28da22742bcfe8495
SHA2568fdeba3ec903bde700342083d16f72452366aa0b1b30d0e58dee0af74cebfa35
SHA51230510bdc34680a0865a0811d9be29dec91c74717feccd58c9b4d88e77be9e5d13a539806a1b2901aff595b2fe2cc45926b69ed42e899d2dd2913c78a732e84d1
-
C:\Windows \System32\Netplwiz.exeMD5
f94b7fb6dac49844d03c7087b2d8b472
SHA10e84139fced0ee8ef929d0bd5f01559a7dcf1db0
SHA25646e31f337ed0d9a6fe3f159abc91c9b9b6a6062982bbcd84a51784d7128e7ae4
SHA512d63878f94f7699e4cc63c2cd885c29455e0c423d32dba750e4fc3aa74dbaca80a1a4b176719213b9fc6584de6a40cddff7864c7fb4cfba13dfcb437a36e41b80
-
C:\Windows \System32\Netplwiz.exeMD5
f94b7fb6dac49844d03c7087b2d8b472
SHA10e84139fced0ee8ef929d0bd5f01559a7dcf1db0
SHA25646e31f337ed0d9a6fe3f159abc91c9b9b6a6062982bbcd84a51784d7128e7ae4
SHA512d63878f94f7699e4cc63c2cd885c29455e0c423d32dba750e4fc3aa74dbaca80a1a4b176719213b9fc6584de6a40cddff7864c7fb4cfba13dfcb437a36e41b80
-
memory/672-76-0x0000000000110000-0x0000000000111000-memory.dmpFilesize
4KB
-
memory/672-65-0x0000000000000000-mapping.dmp
-
memory/672-78-0x0000000000280000-0x0000000000281000-memory.dmpFilesize
4KB
-
memory/672-79-0x0000000010540000-0x0000000010564000-memory.dmpFilesize
144KB
-
memory/672-80-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/672-81-0x00000000000D0000-0x00000000000D1000-memory.dmpFilesize
4KB
-
memory/1140-67-0x0000000000000000-mapping.dmp
-
memory/1676-64-0x0000000075971000-0x0000000075973000-memory.dmpFilesize
8KB
-
memory/1676-61-0x00000000003E0000-0x00000000003FA000-memory.dmpFilesize
104KB
-
memory/1676-59-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1784-69-0x0000000000000000-mapping.dmp
-
memory/1784-82-0x00000000022E0000-0x00000000022E1000-memory.dmpFilesize
4KB