Analysis
- max time kernel
146s - max time network
144s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
13/01/2022, 22:40
General
- Target rápida confirmación.exe
- Size 701KB
- Sample220113-2lm43achf8
- SHA256 c7014edceec0fbe638312dcec8b8d1f0a5bf88dd282fc8ae9ec5d375820d270d
Malware Config
Extracted
-
xloader
-
2.5
-
ariv
-
validationlinkedterms.xyz
-
essentialpraxis.com
-
kjbservicesmn.com
-
wikiofgames.com
-
familiapena2475.com
-
xn--yckc3am9f2et438ajmxc.xyz
-
fluxmmaoffers.com
-
absampee43.com
-
videofx.store
-
metropolitanprofitness.com
-
fc8fla8kzq.com
-
espotplay.com
-
ammarus.com
-
tangerineharbor.com
-
esvengineers.com
-
bullfrogoutdoors.com
-
beefdiets.quest
-
958kk.com
-
triptoursportsaid.com
-
vestontalons.com
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- Xloader
Xloader is a rebranded version of Formbook malware.
- ModiLoader First Stage 1 IoCs
- Xloader Payload 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Suspicious behavior: EnumeratesProcesses 27 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\rápida confirmación.exe"C:\Users\Admin\AppData\Local\Temp\rápida confirmación.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\DpiScaling.exeC:\Windows\System32\DpiScaling.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\DpiScaling.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/536-54-0x00000000763B1000-0x00000000763B3000-memory.dmp
memory/536-55-0x0000000000250000-0x0000000000251000-memory.dmp
memory/536-56-0x0000000000360000-0x0000000000361000-memory.dmp
memory/536-57-0x0000000000361000-0x0000000000375000-memory.dmp
memory/968-65-0x0000000072480000-0x00000000724A9000-memory.dmp
memory/968-58-0x0000000072480000-0x00000000724A9000-memory.dmp
memory/968-64-0x0000000000090000-0x0000000000091000-memory.dmp
memory/968-59-0x0000000000080000-0x0000000000081000-memory.dmp
memory/968-66-0x0000000001FB0000-0x00000000022B3000-memory.dmp
memory/968-67-0x0000000000230000-0x0000000000241000-memory.dmp
memory/1340-72-0x0000000000490000-0x00000000004AF000-memory.dmp
memory/1340-73-0x0000000000080000-0x00000000000A9000-memory.dmp
memory/1340-74-0x0000000001F00000-0x0000000002203000-memory.dmp
memory/1340-75-0x0000000001CC0000-0x0000000001D50000-memory.dmp
memory/1396-68-0x00000000071C0000-0x000000000735A000-memory.dmp
memory/1396-76-0x0000000006A20000-0x0000000006B65000-memory.dmp