Analysis
- max time kernel
153s - max time network
157s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
13/01/2022, 22:40
General
- Target rápida confirmación.exe
- Size 701KB
- Sample220113-2lm43achf8
- SHA256 c7014edceec0fbe638312dcec8b8d1f0a5bf88dd282fc8ae9ec5d375820d270d
Malware Config
Extracted
-
xloader
-
2.5
-
ariv
-
validationlinkedterms.xyz
-
essentialpraxis.com
-
kjbservicesmn.com
-
wikiofgames.com
-
familiapena2475.com
-
xn--yckc3am9f2et438ajmxc.xyz
-
fluxmmaoffers.com
-
absampee43.com
-
videofx.store
-
metropolitanprofitness.com
-
fc8fla8kzq.com
-
espotplay.com
-
ammarus.com
-
tangerineharbor.com
-
esvengineers.com
-
bullfrogoutdoors.com
-
beefdiets.quest
-
958kk.com
-
triptoursportsaid.com
-
vestontalons.com
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- Xloader
Xloader is a rebranded version of Formbook malware.
- ModiLoader First Stage 1 IoCs
- Xloader Payload 4 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 56 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Temp\rápida confirmación.exe"C:\Users\Admin\AppData\Local\Temp\rápida confirmación.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\logagent.exe"5⤵
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2420-133-0x00000000048F0000-0x0000000004980000-memory.dmp
memory/2420-132-0x0000000004CD0000-0x0000000004FF0000-memory.dmp
memory/2420-130-0x00000000013E0000-0x00000000013E6000-memory.dmp
memory/2420-131-0x0000000000C00000-0x0000000000C29000-memory.dmp
memory/2644-116-0x0000000002801000-0x0000000002815000-memory.dmp
memory/2644-117-0x0000000002220000-0x0000000002221000-memory.dmp
memory/2644-115-0x0000000002800000-0x0000000002801000-memory.dmp
memory/3056-124-0x0000000005E70000-0x0000000005FD5000-memory.dmp
memory/3056-127-0x0000000002790000-0x000000000284E000-memory.dmp
memory/3056-134-0x0000000002910000-0x00000000029C2000-memory.dmp
memory/3208-126-0x00000000047E0000-0x00000000047F1000-memory.dmp
memory/3208-125-0x0000000072480000-0x00000000724A9000-memory.dmp
memory/3208-122-0x00000000043E0000-0x0000000004700000-memory.dmp
memory/3208-123-0x00000000043B0000-0x00000000043C1000-memory.dmp
memory/3208-119-0x0000000000A40000-0x0000000000A41000-memory.dmp
memory/3208-120-0x0000000072480000-0x00000000724A9000-memory.dmp